commit 6a3f7ed9e11a2fbd2f88efab0a804ebb8bfcf43f
author Lei Zhang <thestig@chromium.org> Fri Sep 02 04:03:38 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Sep 02 04:03:38 2022 +0000
tree fe49f17d27ec24759d2031f2ba0506ca3f6a4067
parent 2f9d9ed70c6eb2f6ce5e8c9801f08973ae877f78

Improve first page object number validation in a linearized header.

In CPDF_LinearizedHeader, only consider the parsed linearized header to
be valid if the first page object number is less than
`CPDF_Parser::kMaxObjectNumber`.

Change-Id: I7144891480d1e8d98843c6e2dda97026b24d22a6
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/97275
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fpdfapi/parser/cpdf_linearized_header.cpp

diff --git a/core/fpdfapi/parser/cpdf_linearized_header.cpp b/core/fpdfapi/parser/cpdf_linearized_header.cpp
index 1ba724e..4871739 100644
--- a/core/fpdfapi/parser/cpdf_linearized_header.cpp
+++ b/core/fpdfapi/parser/cpdf_linearized_header.cpp
@@ -13,6 +13,7 @@
 #include "core/fpdfapi/parser/cpdf_array.h"
 #include "core/fpdfapi/parser/cpdf_dictionary.h"
 #include "core/fpdfapi/parser/cpdf_number.h"
+#include "core/fpdfapi/parser/cpdf_parser.h"
 #include "core/fpdfapi/parser/cpdf_syntax_parser.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "third_party/base/check.h"
@@ -47,6 +48,7 @@
          header->GetFirstPageNo() < header->GetPageCount() &&
          header->GetMainXRefTableFirstEntryOffset() < document_size &&
          header->GetFirstPageEndOffset() < document_size &&
+         header->GetFirstPageObjNum() < CPDF_Parser::kMaxObjectNumber &&
          header->GetLastXRefOffset() < document_size &&
          header->GetHintStart() < document_size;
 }

core/fpdfapi/parser/cpdf_linearized_header.h

diff --git a/core/fpdfapi/parser/cpdf_linearized_header.h b/core/fpdfapi/parser/cpdf_linearized_header.h
index 5329e92..beed830 100644
--- a/core/fpdfapi/parser/cpdf_linearized_header.h
+++ b/core/fpdfapi/parser/cpdf_linearized_header.h
@@ -32,7 +32,7 @@
   uint32_t GetPageCount() const { return m_PageCount; }
   // Will only return values > 0.
   FX_FILESIZE GetFirstPageEndOffset() const { return m_szFirstPageEndOffset; }
-  // Will only return values > 0.
+  // Will only return values in the range [1, `CPDF_Parser::kMaxObjectNumber`).
   uint32_t GetFirstPageObjNum() const { return m_FirstPageObjNum; }
   // Will only return values > 0.
   FX_FILESIZE GetLastXRefOffset() const { return m_szLastXRefOffset; }