Skip to content

Commit 47dfee2

Browse files
Orycteropes3bk
authored andcommitted
fix panic on 5 bits encryption key
Found this bug while fuzzing the crate. The spec says that /Length must be a multiple of 8 bits, but Decoder::from_password doesn't check for it, and panics if a length of 5 is passed. Return an error if the key length is not a multiple of 8 bits.
1 parent 3187677 commit 47dfee2

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

pdf/src/crypt.rs

+7-1
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,13 @@ impl Decoder {
297297

298298
let (key_bits, method) = match dict.v {
299299
1 => (40, CryptMethod::V2),
300-
2 => (dict.bits, CryptMethod::V2),
300+
2 => {
301+
if dict.bits % 8 != 0 {
302+
err!(other!("invalid key length {}", dict.bits))
303+
} else {
304+
(dict.bits, CryptMethod::V2)
305+
}
306+
},
301307
4 ..= 6 => {
302308
let default = dict
303309
.crypt_filters

0 commit comments

Comments
 (0)