Skip to content

Conversation

vlasovsoft1979
Copy link
Contributor

In some scenarios the following situation is possible in _pdfioFileSeek:

  1. This condition is true: // Reading, see if we already have the data we need...
  2. But pdf->bufend and pdf->bufptr are NULL

In this case we have undefined behavior because

  1. (pdf->bufpos + pdf->bufend - pdf->buffer) now depends on pdf->buffer address only (but not on buffer length)
  2. pdf->bufptr = pdf->buffer + (offset - pdf->bufpos); // now we have pdf->bufptr without pdf->bufend

I came across this situaltion in Linux/i386 architecture only but I think it's possible also for x64.

I propose a simple solution: to check also pdf->bufend.

Copy link
Owner

@michaelrsweet michaelrsweet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically if buffer is NULL then bufend should also be NULL, but a NULL check is easy to add as insurance...

@michaelrsweet michaelrsweet self-assigned this Jan 18, 2025
@michaelrsweet michaelrsweet added enhancement New feature or request priority-low labels Jan 18, 2025
@michaelrsweet michaelrsweet added this to the Stable milestone Jan 18, 2025
@michaelrsweet michaelrsweet merged commit 5fc571b into michaelrsweet:master Jan 18, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request priority-low

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants