[PATCH] ofz: pdf, clamp stream Length to the bytes actually read

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I155f3eddbd204069084b50f52f7cc6328fb053eb
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6118
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 332e8831e0b0e580dae0d77a0ec27bd267af6b29)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207660
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 7906b5a8aac335a0155a90fc6f8310a92e558124)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207678
(cherry picked from commit b4b7fcc1f0551ccdba1ddc520c351eee9bfccd4c)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207777
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Gbp-Pq: Name CVE-2026-63274.diff

diff --git a/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
index 02bbee48d8a826e60902fb230ff319bdd8b791dc..8a5f316ecbad8bb370812fba3d905310a5aac023 100644 (file)
--- a/sdext/source/pdfimport/pdfparse/pdfentries.cxx
+++ b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -701,6 +701,12 @@ bool PDFObject::getDeflatedStream( std::unique_ptr<char[]>& rpStream, unsigned i
             pStream++;
         // get the compressed length
         *pBytes = m_pStream->getDictLength( pObjectContainer );
+        unsigned int nAvailable = nOuterStreamLen - static_cast<unsigned int>(pStream - rpStream.get());
+        if (*pBytes > nAvailable)
+        {
+            SAL_WARN("sdext.pdfimport.pdfparse", "stream /Length " << *pBytes << " exceeds " << nAvailable << " available bytes");
+            *pBytes = nAvailable;
+        }
         if( pStream != rpStream.get() )
             memmove( rpStream.get(), pStream, *pBytes );
         if( rContext.m_bDecrypt )