Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Possible INTEGER_OVERFLOW in filter/pdftopdf/qpdf_cm.cc #42

Closed
aslepykh opened this issue Nov 30, 2023 · 0 comments · Fixed by #43
Closed

Possible INTEGER_OVERFLOW in filter/pdftopdf/qpdf_cm.cc #42

aslepykh opened this issue Nov 30, 2023 · 0 comments · Fixed by #43

Comments

@aslepykh
Copy link

Values of the constant bsize = 2048 and the variable pos are set at qpdf_cm.cc:19 and qpdf_cm.cc:20 :

https://github.com/OpenPrinting/cups-filters/blob/d72184e725591f10e2b404b36fe3bf5bc304a299/filter/pdftopdf/qpdf_cm.cc#L19-L20

Next, these variables go into the while() loop and remain there until the EOF is reached, according to the condition of the if(!feof(f)) loop at qpdf_cm.cc:23

https://github.com/OpenPrinting/cups-filters/blob/d72184e725591f10e2b404b36fe3bf5bc304a299/filter/pdftopdf/qpdf_cm.cc#L23-L30

pos variable is overwritten each time it passes the loop. So it is possible that the function input will receive a file of very large length, which will result in INTEGER_OVERFLOW.

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.
Author A. Slepykh.
@zdohnal zdohnal transferred this issue from OpenPrinting/cups-filters Dec 1, 2023
zdohnal added a commit to zdohnal/libcupsfilters that referenced this issue Dec 1, 2023
@zdohnal
qpdf-cm.cxx: Fix possible integer overflow
e3646ea 
Use unsigned int (we use the variable as string index anyway) and check
if we overflow everytime we increment the variable.

Fixes OpenPrinting#42
@zdohnal zdohnal mentioned this issue Dec 1, 2023
Merged
tillkamppeter pushed a commit that referenced this issue Dec 1, 2023
@zdohnal
qpdf-cm.cxx: Fix possible integer overflow (#43)
9f8cd1e 
Use unsigned int (we use the variable as string index anyway) and check
if we overflow everytime we increment the variable.

Fixes #42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

qpdf-cm.cxx: Fix possible integer overflow zdohnal/libcupsfilters
1 participant
@aslepykh