Sharang Gupta created PDFBOX-6305:
-------------------------------------
Summary: Predictor: reject a zero row length to avoid a
non-terminating decode loop
Key: PDFBOX-6305
URL: https://issues.apache.org/jira/browse/PDFBOX-6305
Project: PDFBox
Issue Type: Improvement
Reporter: Sharang Gupta
PredictorOutputStream validates the calculated row length only against
negatives, so a non-PNG predictor whose /DecodeParms give a zero row length
(for example /Predictor 2 /Columns 0, or /Colors 0, or /BitsPerComponent 0) is
accepted. In write() the loop then copies 0 bytes per iteration and never
advances, so decoding such a stream does not terminate; this is reachable while
decoding a Flate/LZW stream, including the cross-reference stream read at load
time.
PR: https://github.com/apache/pdfbox/pull/553 rejects rowLength <= 0 alongside
the existing negative check, with a PredictorTest case.
No security impact is claimed: per the PDFBox security policy resource
consumption is out of scope, so this is robustness hardening.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
