[Podofo-users] CVE-2017-5855 and CVE-2017-6844

Hi I’ve been trying to write unit tests for CVE-2017-5855 and CVE-2017-6844, and now think both are false positives due to a bug in Address Sanitizer triggered by large values passed to std::vector::resize() The issues were both found with American Fuzzy Lop (AFL) and Address Sanitizer (ASAN).

[Podofo-users] [PATCH] PoFoFo: fix CVE-2018-5296 by reducing limit in s_nMaxObjects

Hi Here’s a simple patch for CVE-2018-5296 – it reduces the limit returned by GetMaxObjectCount from std::numeric_limits::max() to 8,388,607 which is the limit for for the maximum number of indirect objects specified in Table C.1 in Appendix C.2 Architectural Limits in PDF 32000-1:2008 Best Re