PdfDocument.Open crashes with IndexOutOfRangeException on malformed PDF

[pawlos]

Fuzzing PdfPig 0.1.13 with AFL++ and SharpFuzz found a crash in PdfTokenScanner.TryReadStream triggered by a malformed PDF (530 bytes). The stream offset/length parsed from a PDF object is not validated against the document byte array bounds before reading, leading to an IndexOutOfRangeException.

This is exploitable for denial of service — any application that parses user-supplied PDFs using PdfPig will crash on this input.

System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at UglyToad.PdfPig.Tokenization.Scanner.PdfTokenScanner.TryReadStream(Int64 startStreamTokenOffset, Boolean getLength, StreamToken& stream)

Reproduction Code

using UglyToad.PdfPig;

var data = Convert.FromHexString(
    "255044462d312e300a312030206f626a3c3c2f547970652f436174616c6f672f50616765" +
    "732032203020523e3e656e646f626a0a322030206f626a3c3c2f547970652f5061676573" +
    "2f4b6964735b33203020525d2f436f756e7420313e3e656e646f626a0a332030206f626a" +
    "3c3c2f547970652f506167652f4d65646961426f785b30083020363132203739325d2f50" +
    "6172656e742032203020522f5265736f75726365733c3c2f466f6e743c3c2f4631203420" +
    "3020523e3e3e3e2f436f6e74656e74732035203020523e3e656e646f626a0a342030206f" +
    "626a3c3c2f547970652f466f6e742f537562747970652f54797065312f42617365466f6e" +
    "742f48656c7665746963613e3e656e646f626a0a352030206f626a3c3c2f4c656e677468" +
    "2034343e3e73747265616d0a4254202f463120313220546620313030203730302054646c" +
    "6c6f2920546a2045540a656e6473747265616d20656e646f626a0a787265660a3020360a" +
    "303030303030303030302036353533352066200a303030303030303030392030303030" +
    "30206e200a30303030303030303538203030303030206e200a303030303030303131352030" +
    "3030303030206e200a30303030303030323636203030303030206e200a30303030303030" +
    "333333203030303030206e200a747261696c65723c3c2f53697a6520362f526f6f74203120" +
    "3020523e3e0a7374617274787265660a3432370a2525454f460a");

try
{
    using var doc = PdfDocument.Open(data);
    foreach (var page in doc.GetPages())
    {
        _ = page.Text;
        _ = page.Letters;
    }
}
catch (Exception ex)
{
    Console.WriteLine($"{ex.GetType().Name}: {ex.Message}");
}

Steps to Reproduce

1. Create a .NET console app and add PdfPig 0.1.13 NuGet package
2. Paste the reproduction code above
3. Run the app
4. Observe IndexOutOfRangeException

Expected Behavior

PdfDocument.Open should throw PdfDocumentFormatException for malformed PDFs, not crash with IndexOutOfRangeException.

Root Cause

The stream length or start offset parsed from the PDF stream object is not validated against the document byte array bounds before indexing into it in TryReadStream.

Additional Context

• Severity: Medium (denial of service)
• Attack vector: Any application using PdfDocument.Open to parse untrusted PDFs
• Effect: Unhandled exception terminates the process
• Workaround: Wrap PdfDocument.Open in a try/catch for IndexOutOfRangeException
• Verified still present on 0.1.14-alpha-20260315-fb715, and main branch
• Found via coverage-guided fuzzing with AFL++ and SharpFuzz

[BobLd]

@pawlos can you check with the latest pre-release version of PdfPig?

[pawlos]

@BobLd sure, I'll run it today and see if anything's left

[pawlos]

@BobLd it seems like I'm still getting the crash. Do you have any particular commit sha that should be fixing this?