svn commit: r1937478 - pdfbox/branches/3.0/pdfbox/src/main/java/org/apache/pdfbox/filter

[tilman]

Author: tilman
Date: Wed Aug 26 08:14:09 2026
New Revision: 1937478

Log:
PDFBOX-6243: improve validate dimension to avoid OOM

Modified:
   
pdfbox/branches/3.0/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxFilter.java

Modified: 
pdfbox/branches/3.0/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxFilter.java
==============================================================================
--- 
pdfbox/branches/3.0/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxFilter.java
       Wed Aug 26 08:14:05 2026        (r1937477)
+++ 
pdfbox/branches/3.0/pdfbox/src/main/java/org/apache/pdfbox/filter/CCITTFaxFilter.java
       Wed Aug 26 08:14:09 2026        (r1937478)
@@ -67,6 +67,9 @@ final class CCITTFaxFilter extends Filte
 
         long arraySizeLong = ((long) cols + 7) / 8 * rows;
 
+        // PDFBOX-6243: CCITTFaxDecoderStream allocates two int arrays: 
changesReferenceRow and changesCurrentRow 
+        long changesSize = ((long) cols + 2) * 4 * 2;
+
         long maxBytes = 256 * 1024 * 1024L;
         String sysProp = System.getProperty(Filter.SYSPROP_CCITTFAX_MAXBYTES);
 
@@ -87,10 +90,11 @@ final class CCITTFaxFilter extends Filte
             }
         }
 
-        if (arraySizeLong > maxBytes)
+        if (arraySizeLong + changesSize > maxBytes)
         {
             throw new IOException(
-                "CCITT decode buffer too large (" + arraySizeLong + " bytes) 
for cols=" + cols +
+                "CCITT decode buffer too large (bitmapSize: " + arraySizeLong 
+ ", changesSize: " +
+                changesSize + ") for cols=" + cols +
                 ", rows=" + rows + "; max allowed=" + maxBytes +
                 "; increase " + Filter.SYSPROP_CCITTFAX_MAXBYTES + " to 
override"
             );