#131 [podofo-0.9.7]Stack-Overflow in src/podofo/doc/PdfNamesTree.cpp

[treebacker]

In source code src/podofo/doc/PdfNamesTree.cpp:486.

Function PdfNamesTree::AddToDictionary has a recursve call .

void PdfNamesTree::AddToDictionary( PdfObject* pObj, PdfDictionary & rDict )
{
    if( pObj->GetDictionary().HasKey("Kids") )
    {
        const PdfArray & kids       = pObj->MustGetIndirectKey("Kids")->GetArray();
        PdfArray::const_iterator it = kids.begin();

        while( it != kids.end() )
        {
            PdfObject* pChild = this->GetObject()->GetOwner()->GetObject( (*it).GetReference() );
            if( pChild ) 
                this->AddToDictionary( pChild, rDict ); // Recursive here
            else
                PdfError::LogMessage( eLogSeverity_Debug, "Object %lu %lu is child of nametree but was not found!\n", 
                                      (*it).GetReference().ObjectNumber(), 
                                      (*it).GetReference().GenerationNumber() );

            ++it;
        }
    }
   ....

With crafted pdf file, it will raise a stack overflow.

In command line: podofopdfinfo/podofopdfinfo bug3

The crafted file is attached.

[Mattia Rizzolo]

This is CVE-2021-30471