[PATCH] ofz: pdf, check record againsts max allowed size

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I51a31c1e09d2b5d5a413c5345c40998e032f09d6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6117
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit e230b10b7cd2d5d8623cdba0877ec68f67003690)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207659
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 21124741e0134f0f1222a42726c223bf6da41dca)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207674
(cherry picked from commit 3a92ea5af6d1bf3820ce0909fb9de003565ebf2b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207684
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Gbp-Pq: Name CVE-2026-63273.diff

diff --git a/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
index 856dc373bf366006734e0e1fe46b214d9f6ebf20..02bbee48d8a826e60902fb230ff319bdd8b791dc 100644 (file)
--- a/sdext/source/pdfimport/pdfparse/pdfentries.cxx
+++ b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -1346,7 +1346,15 @@ PDFFileImplData* PDFFile::impl_getData() const
                         {
                             PDFNumber* pNum = dynamic_cast<PDFNumber*>(len->second);
                             if( pNum )
-                                m_pData->m_nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+                            {
+                                sal_uInt32 nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+                                if (nKeyLength > ENCRYPTION_KEY_LEN)
+                                {
+                                    SAL_WARN("sdext.pdfimport.pdfparse", "entry has length " << nKeyLength << " which is greater than " << ENCRYPTION_KEY_LEN);
+                                    nKeyLength = ENCRYPTION_KEY_LEN;
+                                }
+                                m_pData->m_nKeyLength = nKeyLength;
+                            }
                         }
                         PDFName* pFilter = dynamic_cast<PDFName*>(filter->second);
                         if( pFilter && pFilter->getFilteredName() == "Standard" )