[
https://issues.apache.org/jira/browse/PDFBOX-6305?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sharang Gupta updated PDFBOX-6305:
----------------------------------
Priority: Minor (was: Blocker)
> Predictor: reject a zero row length to avoid a non-terminating decode loop
> --------------------------------------------------------------------------
>
> Key: PDFBOX-6305
> URL: https://issues.apache.org/jira/browse/PDFBOX-6305
> Project: PDFBox
> Issue Type: Improvement
> Reporter: Sharang Gupta
> Priority: Minor
>
> PredictorOutputStream validates the calculated row length only against
> negatives, so a non-PNG predictor whose /DecodeParms give a zero row length
> (for example /Predictor 2 /Columns 0, or /Colors 0, or /BitsPerComponent 0)
> is accepted. In write() the loop then copies 0 bytes per iteration and never
> advances, so decoding such a stream does not terminate; this is reachable
> while decoding a Flate/LZW stream, including the cross-reference stream read
> at load time.
> PR: https://github.com/apache/pdfbox/pull/553 rejects rowLength <= 0
> alongside the existing negative check, with a PredictorTest case.
> No security impact is claimed: per the PDFBox security policy resource
> consumption is out of scope, so this is robustness hardening.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
