From: Caolán McNamara <caolan.mcnamara@collabora.com>
Date: Sat, 4 Jul 2026 15:00:32 +0000 (+0000)
Subject: [PATCH] ofz: pdf, clamp stream Length to the bytes actually read
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u7^2~5
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=2a02face8cbc4e2279f4b0206504ba06fe0e3157;p=libreoffice.git

[PATCH] ofz: pdf, clamp stream Length to the bytes actually read

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I155f3eddbd204069084b50f52f7cc6328fb053eb
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6118
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 332e8831e0b0e580dae0d77a0ec27bd267af6b29)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207660
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
(cherry picked from commit 7906b5a8aac335a0155a90fc6f8310a92e558124)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207678
(cherry picked from commit b4b7fcc1f0551ccdba1ddc520c351eee9bfccd4c)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207777
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>

Gbp-Pq: Name CVE-2026-63274.diff
---

diff --git a/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
index 02bbee48d8a..8a5f316ecba 100644
--- a/sdext/source/pdfimport/pdfparse/pdfentries.cxx
+++ b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -701,6 +701,12 @@ bool PDFObject::getDeflatedStream( std::unique_ptr<char[]>& rpStream, unsigned i
             pStream++;
         // get the compressed length
         *pBytes = m_pStream->getDictLength( pObjectContainer );
+        unsigned int nAvailable = nOuterStreamLen - static_cast<unsigned int>(pStream - rpStream.get());
+        if (*pBytes > nAvailable)
+        {
+            SAL_WARN("sdext.pdfimport.pdfparse", "stream /Length " << *pBytes << " exceeds " << nAvailable << " available bytes");
+            *pBytes = nAvailable;
+        }
         if( pStream != rpStream.get() )
             memmove( rpStream.get(), pStream, *pBytes );
         if( rContext.m_bDecrypt )