[PDFBOX-4451] ArrayIndexOutOfBoundsException in PDRectangle constructor

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.13
• Fix Version/s: 2.0.14, 3.0.0 PDFBox
• Component/s: PDModel
• Assignee: Tilman Hausherr
• Reporter: Robin Schimpf
• Created: 30/Jan/19 20:40
• Updated: 28/Feb/19 17:45
• Resolved: 31/Jan/19 08:00

Description

Fuzzing PDF merging with JQF triggered an ArrayIndexOutOfBoundsException. The attached file is merged with itself.

java.lang.ArrayIndexOutOfBoundsException: 3

	at org.apache.pdfbox.pdmodel.common.PDRectangle.<init>(PDRectangle.java:135)
	at org.apache.pdfbox.pdmodel.PDPage.getMediaBox(PDPage.java:281)
	at org.apache.pdfbox.pdmodel.PDPage.getCropBox(PDPage.java:325)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.appendDocument(PDFMergerUtility.java:740)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.legacyMergeDocuments(PDFMergerUtility.java:390)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.mergeDocuments(PDFMergerUtility.java:276)
...

The Code used for fuzzing is

try (OutputStream out = new ByteArrayOutputStream()) {
    PDFMergerUtility pdfMergerUtility = new PDFMergerUtility();
    pdfMergerUtility.addSource(file);
    pdfMergerUtility.addSource(file);
    pdfMergerUtility.setDestinationStream(out);
    pdfMergerUtility.mergeDocuments(MemoryUsageSetting.setupMainMemoryOnly());
}