File 0008-Fix-infinite-loop-in-GetPageNumber-if-Pare... of Package podofo

Overview Repositories Revisions Requests Users Attributes Meta

File 0008-Fix-infinite-loop-in-GetPageNumber-if-Parent-chain-contains-a-loop.patch of Package podofo (Revision 4a2a4ab3a9916f93b2c4aaa0d77f380b)

Currently displaying revision 4a2a4ab3a9916f93b2c4aaa0d77f380b , Show latest

Subject: Patch by Mark Rogers: Fix infinite loop in GetPageNumber() if Parent chain contains a loop
Url: https://sourceforge.net/p/podofo/code/1841/

--- a/podofo/trunk/src/doc/PdfPage.cpp
+++ b/podofo/trunk/src/doc/PdfPage.cpp
@@ -543,6 +543,11 @@
     PdfObject*          pParent     = this->GetObject()->GetIndirectKey( "Parent" );
     PdfReference ref                = this->GetObject()->Reference();
 
+    // CVE-2017-5852 - prevent infinite loop if Parent chain contains a loop
+    // e.g. pParent->GetIndirectKey( "Parent" ) == pParent or pParent->GetIndirectKey( "Parent" )->GetIndirectKey( "Parent" ) == pParent
+    const int maxRecursionDepth = 1000;
+    int depth = 0;
+
     while( pParent ) 
     {
         PdfObject* pKids = pParent->GetIndirectKey( "Kids" );
@@ -574,6 +579,12 @@
 
         ref     = pParent->Reference();
         pParent = pParent->GetIndirectKey( "Parent" );
+        ++depth;
+
+        if ( depth > maxRecursionDepth )
+        {
+            PODOFO_RAISE_ERROR_INFO( ePdfError_BrokenFile, "Loop in Parent chain" );
+        }
     }
 
     return ++nPageNumber;

Places

File 0008-Fix-infinite-loop-in-GetPageNumber-if-Parent-chain-contains-a-loop.patch of Package podofo (Revision 4a2a4ab3a9916f93b2c4aaa0d77f380b)

Places