[PDFBOX-4452] ClassCastException in PDPageTree

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.13
• Fix Version/s: 2.0.14, 3.0.0 PDFBox
• Component/s: PDModel
• Assignee: Tilman Hausherr
• Reporter: Robin Schimpf
• Created: 30/Jan/19 20:43
• Updated: 28/Feb/19 17:44
• Resolved: 31/Jan/19 07:37

Description

Fuzzing PDF merging with JQF triggered an ClassCastException. The attached file is merged with itself.

java.lang.ClassCastException: org.apache.pdfbox.cos.COSInteger cannot be cast to org.apache.pdfbox.cos.COSDictionary

	at org.apache.pdfbox.pdmodel.PDPageTree.getKids(PDPageTree.java:144)
	at org.apache.pdfbox.pdmodel.PDPageTree.access$200(PDPageTree.java:38)
	at org.apache.pdfbox.pdmodel.PDPageTree$PageIterator.enqueueKids(PDPageTree.java:166)
	at org.apache.pdfbox.pdmodel.PDPageTree$PageIterator.<init>(PDPageTree.java:159)
	at org.apache.pdfbox.pdmodel.PDPageTree$PageIterator.<init>(PDPageTree.java:153)
	at org.apache.pdfbox.pdmodel.PDPageTree.iterator(PDPageTree.java:123)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.appendDocument(PDFMergerUtility.java:737)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.legacyMergeDocuments(PDFMergerUtility.java:390)
	at org.apache.pdfbox.multipdf.PDFMergerUtility.mergeDocuments(PDFMergerUtility.java:276)
...

The Code used for fuzzing is

try (OutputStream out = new ByteArrayOutputStream()) {
    PDFMergerUtility pdfMergerUtility = new PDFMergerUtility();
    pdfMergerUtility.addSource(file);
    pdfMergerUtility.addSource(file);
    pdfMergerUtility.setDestinationStream(out);
    pdfMergerUtility.mergeDocuments(MemoryUsageSetting.setupMainMemoryOnly());
}