From: Caolán McNamara <caolan.mcnamara@collabora.com>
Date: Sat, 4 Jul 2026 14:43:32 +0000 (+0100)
Subject: [PATCH] ofz: pdf, check record againsts max allowed size
X-Git-Tag: archive/raspbian/4%25.2.3-2+rpi1+deb13u7^2~6
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=b51b35249634fc9f03f5630a768e700682c29343;p=libreoffice.git

[PATCH] ofz: pdf, check record againsts max allowed size

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I51a31c1e09d2b5d5a413c5345c40998e032f09d6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6117
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit e230b10b7cd2d5d8623cdba0877ec68f67003690)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207659
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
(cherry picked from commit 21124741e0134f0f1222a42726c223bf6da41dca)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207674
(cherry picked from commit 3a92ea5af6d1bf3820ce0909fb9de003565ebf2b)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/207684
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Michael Weghorn <m.weghorn@posteo.de>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice@googlemail.com>

Gbp-Pq: Name CVE-2026-63273.diff
---

diff --git a/sdext/source/pdfimport/pdfparse/pdfentries.cxx b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
index 856dc373bf3..02bbee48d8a 100644
--- a/sdext/source/pdfimport/pdfparse/pdfentries.cxx
+++ b/sdext/source/pdfimport/pdfparse/pdfentries.cxx
@@ -1346,7 +1346,15 @@ PDFFileImplData* PDFFile::impl_getData() const
                         {
                             PDFNumber* pNum = dynamic_cast<PDFNumber*>(len->second);
                             if( pNum )
-                                m_pData->m_nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+                            {
+                                sal_uInt32 nKeyLength = static_cast<sal_uInt32>(pNum->m_fValue) / 8;
+                                if (nKeyLength > ENCRYPTION_KEY_LEN)
+                                {
+                                    SAL_WARN("sdext.pdfimport.pdfparse", "entry has length " << nKeyLength << " which is greater than " << ENCRYPTION_KEY_LEN);
+                                    nKeyLength = ENCRYPTION_KEY_LEN;
+                                }
+                                m_pData->m_nKeyLength = nKeyLength;
+                            }
                         }
                         PDFName* pFilter = dynamic_cast<PDFName*>(filter->second);
                         if( pFilter && pFilter->getFilteredName() == "Standard" )