summaryrefslogtreecommitdiff
path: root/backport-CVE-2022-38349.patch
blob: 5ba9d9acf91e5d1d963c42d7404c25b5665c4476 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
From 4564a002bcb6094cc460bc0d5ddff9423fe6dd28 Mon Sep 17 00:00:00 2001
From: crt <chluo@cse.cuhk.edu.hk>
Date: Sat, 13 Aug 2022 16:53:11 +0000
Subject: [PATCH] pdfunite: Fix crash on broken files

---
 poppler/PDFDoc.cc |  6 +++++-
 poppler/PDFDoc.h  |  2 +-
 utils/pdfunite.cc | 11 ++++++++---
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/poppler/PDFDoc.cc b/poppler/PDFDoc.cc
index fcc17a4..7beabe1 100644
--- a/poppler/PDFDoc.cc
+++ b/poppler/PDFDoc.cc
@@ -1795,12 +1795,15 @@ bool PDFDoc::markObject (Object* obj, XRef *xRef, XRef *countRef, unsigned int n
   return true;
 }
 
-void PDFDoc::replacePageDict(int pageNo, int rotate,
+bool PDFDoc::replacePageDict(int pageNo, int rotate,
                              const PDFRectangle *mediaBox,
                              const PDFRectangle *cropBox)
 {
   Ref *refPage = getCatalog()->getPageRef(pageNo);
   Object page = getXRef()->fetch(*refPage);
+  if (!page.isDict()) {
+      return false;
+  }
   Dict *pageDict = page.getDict();
   pageDict->remove("MediaBoxssdf");
   pageDict->remove("MediaBox");
@@ -1830,6 +1833,7 @@ void PDFDoc::replacePageDict(int pageNo, int rotate,
   pageDict->add("TrimBox", std::move(trimBoxObject));
   pageDict->add("Rotate", Object(rotate));
   getXRef()->setModifiedObject(&page, *refPage);
+  return true;
 }
 
 bool PDFDoc::markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts)
diff --git a/poppler/PDFDoc.h b/poppler/PDFDoc.h
index b504004..1295d8a 100644
--- a/poppler/PDFDoc.h
+++ b/poppler/PDFDoc.h
@@ -332,7 +332,7 @@ public:
   void *getGUIData() { return guiData; }
 
   // rewrite pageDict with MediaBox, CropBox and new page CTM
-  void replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
+  bool replacePageDict(int pageNo, int rotate, const PDFRectangle *mediaBox, const PDFRectangle *cropBox);
   bool markPageObjects(Dict *pageDict, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
   bool markAnnotations(Object *annots, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldPageNum, int newPageNum, std::set<Dict*> *alreadyMarkedDicts = nullptr);
   void markAcroForm(Object *afObj, XRef *xRef, XRef *countRef, unsigned int numOffset, int oldRefNum, int newRefNum);
diff --git a/utils/pdfunite.cc b/utils/pdfunite.cc
index 9735096..60cd227 100644
--- a/utils/pdfunite.cc
+++ b/utils/pdfunite.cc
@@ -299,9 +299,14 @@ int main (int argc, char *argv[])
       const PDFRectangle *cropBox = nullptr;
       if (docs[i]->getCatalog()->getPage(j)->isCropped())
         cropBox = docs[i]->getCatalog()->getPage(j)->getCropBox();
-      docs[i]->replacePageDict(j,
-	    docs[i]->getCatalog()->getPage(j)->getRotate(),
-	    docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox);
+      if (!docs[i]->replacePageDict(j, docs[i]->getCatalog()->getPage(j)->getRotate(), docs[i]->getCatalog()->getPage(j)->getMediaBox(), cropBox)) {
+          fclose(f);
+          delete yRef;
+          delete countRef;
+          delete outStr;
+          error(errSyntaxError, -1, "PDFDoc::replacePageDict failed.");
+          return -1;
+      }
       Ref *refPage = docs[i]->getCatalog()->getPageRef(j);
       Object page = docs[i]->getXRef()->fetch(*refPage);
       Dict *pageDict = page.getDict();
-- 
2.33.0