Skip to content

Commit a94544d

Browse files
Orycteropes3bk
authored andcommitted
fix panic on malformed trailer ID
Found this bug by fuzzing. If the trailer ID is an empty array, load_storage_and_trailer_password() will panic when trying to access the first byte of an encrypted document. Note that shouldn't happen on valid documents, the ID is supposed to be a an array of two byte strings.
1 parent a40dbef commit a94544d

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

pdf/src/file.rs

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,12 @@ where
164164
typ: "Trailer",
165165
field: "ID".into(),
166166
})?
167-
.as_array()?[0]
167+
.as_array()?
168+
.get(0)
169+
.ok_or(PdfError::MissingEntry {
170+
typ: "Trailer",
171+
field: "ID[0]".into()
172+
})?
168173
.as_string()?
169174
.as_bytes();
170175

0 commit comments

Comments
 (0)