octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-11-16 17:45:09 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1294 from m-holger/fuzz

Browse Source 
Add additional xref and object stream sanity checks
This commit is contained in:
m-holger 2024-09-28 01:02:32 +01:00 committed by GitHub
commit 2cb2412fbf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fuzz/CMakeLists.txt
View File

@ -146,6 +146,9 @@ set(CORPUS_OTHER
99999b.fuzz 99999b.fuzz
99999c.fuzz 99999c.fuzz
99999d.fuzz 99999d.fuzz
99999e.fuzz
369662293.fuzz
369662293a.fuzz
) )
set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)

BIN
fuzz/qpdf_extra/369662293.fuzz Normal file
View File

Binary file not shown.

BIN
fuzz/qpdf_extra/369662293a.fuzz Normal file
View File

Binary file not shown.

BIN
fuzz/qpdf_extra/99999e.fuzz Normal file
View File

Binary file not shown.

2
fuzz/qtest/fuzz.test
View File

@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
my $n_qpdf_files = 83; # increment when adding new files my $n_qpdf_files = 86; # increment when adding new files
my @fuzzers = ( my @fuzzers = (
['ascii85' => 1], ['ascii85' => 1],

13
libqpdf/QPDF.cc
View File

@ -1295,6 +1295,9 @@ QPDF::Xref_table::process_stream(qpdf_offset_t xref_offset, QPDFObjectHandle& xr
if (!trailer_) { if (!trailer_) {
trailer_ = dict; trailer_ = dict;
if (size > toS(max_id_)) {
throw damaged("Cross-reference stream /Size entry is impossibly large");
}
table.resize(size); table.resize(size);
} }
@ -2061,6 +2064,7 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
(m->file->getName() + " object stream " + std::to_string(obj_stream_number)), (m->file->getName() + " object stream " + std::to_string(obj_stream_number)),
bp.get())); bp.get()));
qpdf_offset_t last_offset = -1;
for (int i = 0; i < n; ++i) { for (int i = 0; i < n; ++i) {
QPDFTokenizer::Token tnum = readToken(*input); QPDFTokenizer::Token tnum = readToken(*input);
QPDFTokenizer::Token toffset = readToken(*input); QPDFTokenizer::Token toffset = readToken(*input);
@ -2086,6 +2090,15 @@ QPDF::resolveObjectsInStream(int obj_stream_number)
"object stream claims to contain itself")); "object stream claims to contain itself"));
continue; continue;
} }
if (offset <= last_offset) {
throw damagedPDF(
*input,
m->last_object_description,
input->getLastOffset(),
"expected offsets in object stream to be increasing");
}
last_offset = offset;
offsets[num] = toI(offset + first); offsets[num] = toI(offset + first);
} }