Commit 38967820c for clamav.net
commit 38967820c248a7a21300e313b6f1ca20b3521814
Author: Val S. <valsnyde@cisco.com>
Date: Fri Aug 7 13:46:42 2026 -0400
Libclamav: guard PDF hex string newline skip (#69)
The PDF hex-string reader skips newlines immediately after the opening
angle bracket. A malformed string can consume the remaining bounded input
before the parser searches for the closing bracket.
Return early when the bounded length is exhausted so the parser does not
pass an underflowed length to memchr().
Reported-by: Tristan (@TristanInSec)
CLAM-3002
diff --git a/libclamav/pdf.c b/libclamav/pdf.c
index d074aab6b..d743847d0 100644
--- a/libclamav/pdf.c
+++ b/libclamav/pdf.c
@@ -2752,6 +2752,8 @@ static char *pdf_readstring(const char *q0, int len, const char *key, unsigned *
start = ++q;
len -= 1;
}
+ if (len <= 0)
+ return NULL;
q = memchr(q + 1, '>', len - 1);
if (!q)
return NULL;