octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-12-22 10:58:58 +00:00
Code Issues Releases Wiki Activity

Further limit size of uncompressed JPEG for fuzzing

Browse Source 
Try a  limit of 50MB. For very large limits processing time before
damage is encountered may exceed oss-fuzz limits.
Add further test cases.
This commit is contained in:
m-holger 2024-07-11 13:27:50 +01:00
parent e914bbbbbc
commit 722148de3d
5 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
fuzz/dct_fuzzer_seed_corpus/25297ce5437bb882fbbd5073334d2eb64fb9c40b Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 28 KiB

BIN
fuzz/dct_fuzzer_seed_corpus/f48621948bc5b8c7debabe2fbec04cad56927e12 Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 862 KiB

2
fuzz/qtest/fuzz.test
View File

@ -13,7 +13,7 @@ my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
my @fuzzers = ( my @fuzzers = (
['ascii85' => 1], ['ascii85' => 1],
['dct' => 2], ['dct' => 4],
['flate' => 1], ['flate' => 1],
['hex' => 1], ['hex' => 1],
['json' => 40], ['json' => 40],

9
libqpdf/Pl_DCT.cc
View File

@ -335,10 +335,11 @@ Pl_DCT::decompress(void* cinfo_p, Buffer* b)
(void)jpeg_calc_output_dimensions(cinfo); (void)jpeg_calc_output_dimensions(cinfo);
unsigned int width = cinfo->output_width * QIntC::to_uint(cinfo->output_components); unsigned int width = cinfo->output_width * QIntC::to_uint(cinfo->output_components);
if (memory_limit > 0 && if (memory_limit > 0 &&
width > (static_cast<unsigned long>(memory_limit) / (2U * cinfo->output_height))) { width > (static_cast<unsigned long>(memory_limit) / (20U * cinfo->output_height))) {
// Even if jpeglib does not run out of memory, qpdf will while buffering thye data before // Even if jpeglib does not run out of memory, qpdf will while buffering the data before
// writing it. // writing it. Furthermore, for very large images runtime can be significant before the
throw std::runtime_error("Pl_DCT::decompress: JPEG data exceeds memory limit"); // first warning is encountered causing a timeout in oss-fuzz.
throw std::runtime_error("Pl_DCT::decompress: JPEG data large - may be too slow");
} }
JSAMPARRAY buffer = JSAMPARRAY buffer =
(*cinfo->mem->alloc_sarray)(reinterpret_cast<j_common_ptr>(cinfo), JPOOL_IMAGE, width, 1); (*cinfo->mem->alloc_sarray)(reinterpret_cast<j_common_ptr>(cinfo), JPOOL_IMAGE, width, 1);

2
libqpdf/QPDF_pages.cc
View File

@ -99,7 +99,7 @@ QPDF::getAllPagesInternal(
for (int i = 0; i < n; ++i) { for (int i = 0; i < n; ++i) {
auto kid = kids.getArrayItem(i); auto kid = kids.getArrayItem(i);
if (!kid.isDictionary()) { if (!kid.isDictionary()) {
kid.warnIfPossible("Pages tree includes non-dictionary object; removing"); kid.warnIfPossible("Pages tree includes non-dictionary object; ignoring");
continue; continue;
} }
if (kid.hasKey("/Kids")) { if (kid.hasKey("/Kids")) {