Add sanity check for xref stream /Size entry

sthagen · Sep 27, 2024 · 1b6a504 · 1b6a504
1 parent 529501a
commit 1b6a504
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc
@@ -1295,6 +1295,9 @@ QPDF::Xref_table::process_stream(qpdf_offset_t xref_offset, QPDFObjectHandle& xr
 
     if (!trailer_) {
         trailer_ = dict;
+        if (size > toS(max_id_)) {
+            throw damaged("Cross-reference stream /Size entry is impossibly large");
+        }
         table.resize(size);
     }