svn commit: r1938243 - pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter

[tilman]

Author: tilman
Date: Tue Sep 15 11:37:37 2026
New Revision: 1938243

Log:
PDFBOX-6265: protect against extreme decodeParms values

Modified:
   pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java
   pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java

Modified: pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java
==============================================================================
--- pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java      
Tue Sep 15 11:37:32 2026        (r1938242)
+++ pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Filter.java      
Tue Sep 15 11:37:37 2026        (r1938243)
@@ -71,6 +71,14 @@ public abstract class Filter
     public static final String SYSPROP_CCITTFAX_MAXBYTES = 
"org.apache.pdfbox.filter.ccittmaxbytes";
 
     /**
+     * PredictorOutputStream max rowLength property, obtained by computing
+     * {@code (columns * colors * bitsPerComponent + 7) / 8}. To raise the cap 
for
+     * high-resolution legitimate documents, use
+     * {@code System.setProperty(Filter.SYSPROP_CCITTFAX_MAXBYTES, 
String.valueOf(10_000_000));}
+     */
+    public static final String SYSPROP_PREDICTOR_MAX_ROW_LENGTH = 
"org.apache.pdfbox.filter.predictormaxrowlength";
+
+    /**
      * Constructor.
      */
     protected Filter()

Modified: 
pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java
==============================================================================
--- pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java   
Tue Sep 15 11:37:32 2026        (r1938242)
+++ pdfbox/trunk/pdfbox/src/main/java/org/apache/pdfbox/filter/Predictor.java   
Tue Sep 15 11:37:37 2026        (r1938243)
@@ -289,6 +289,16 @@ public final class Predictor
             {
                 throw new IOException("Calculated row length is negative: " + 
rowLength);
             }
+            // PDFBOX-6265: prevent OOM with extreme values
+            long maxRowLength = 10_000_000L;
+            if (rowLength > maxRowLength)
+            {
+                String msg =
+                        String.format("Calculated row length is too high: %d "
+                                + "(colors: %d, bitsPerComponent: %d, columns: 
%d)",
+                                rowLength, colors, bitsPerComponent, columns);
+                throw new IOException(msg);
+            }
             this.predictorPerRow = predictor >= 10;
             currentRow = new byte[rowLength];
             lastRow = new byte[rowLength];