Skip to content

Commit

Permalink
fix panic on malformed trailer ID
Browse files Browse the repository at this point in the history
Found this bug by fuzzing.

If the trailer ID is an empty array, load_storage_and_trailer_password() will
panic when trying to access the first byte of an encrypted document.

Note that shouldn't happen on valid documents, the ID is supposed to be a
an array of two byte strings.
  • Loading branch information
Orycterope authored and s3bk committed Aug 2, 2024
1 parent a40dbef commit a94544d
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion pdf/src/file.rs
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,12 @@ where
typ: "Trailer",
field: "ID".into(),
})?
.as_array()?[0]
.as_array()?
.get(0)
.ok_or(PdfError::MissingEntry {
typ: "Trailer",
field: "ID[0]".into()
})?
.as_string()?
.as_bytes();

Expand Down

0 comments on commit a94544d

Please sign in to comment.