octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2025-02-02 03:48:24 +00:00
Code Issues Releases Wiki Activity

Avoid leak by resolving object streams more than once (fuzz issue 23642)

Browse Source
This commit is contained in:
Jay Berkenbilt 2020-10-22 15:19:48 -04:00
parent 30bb4c64ee
commit 8a11feacc3
7 changed files with 182 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
TODO
View File

@ -1,9 +1,6 @@
Candidates for upcoming release
===============================
* Fuzz crashes
* See "New" below
* Open "next" issues
* bugs
* #473: zsh completion with directories
@ -64,9 +61,6 @@ Fuzz Errors
* https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=<N>
* New:
* 23642: leak: https://oss-fuzz.com/testcase-detail/4906569690251264
* Ignoring these:
* Problems inside the jpeg library: 15470, 15751, 18633, 18732,
18745, 20391, 23581

176
fuzz/qpdf_extra/23642-mod.fuzz Normal file
View File

File diff suppressed because one or more lines are too long

BIN
fuzz/qpdf_extra/23642.fuzz Normal file
View File

Binary file not shown.

1
include/qpdf/QPDF.hh
View File

@ -1403,6 +1403,7 @@ class QPDF
bool immediate_copy_from;
bool in_parse;
bool parsed;
std::set<int> resolved_object_streams;
// Linearization data
qpdf_offset_t first_xref_item_offset; // actual value from file

5
libqpdf/QPDF.cc
View File

@ -2082,6 +2082,11 @@ QPDF::resolve(int objid, int generation)
void
QPDF::resolveObjectsInStream(int obj_stream_number)
{
if (this->m->resolved_object_streams.count(obj_stream_number))
{
return;
}
this->m->resolved_object_streams.insert(obj_stream_number);
// Force resolution of object stream
QPDFObjectHandle obj_stream = getObjectByID(obj_stream_number, 0);
if (! obj_stream.isStream())

2
qpdf/qtest/qpdf/fuzz-16214.out
View File

@ -11,8 +11,6 @@ WARNING: fuzz-16214.pdf (object 1 0, offset 7189): expected n n obj
WARNING: fuzz-16214.pdf: Attempting to reconstruct cross-reference table
WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
WARNING: fuzz-16214.pdf (object 11 0, offset 11551): supposed object stream 5 has wrong type
WARNING: fuzz-16214.pdf (object 21 0, offset 3639): expected endstream
WARNING: fuzz-16214.pdf (object 21 0, offset 3112): attempting to recover stream length

2
qpdf/qtest/qpdf/issue-143.out
View File

@ -15,6 +15,4 @@ WARNING: issue-143.pdf (object 1 0, offset 84): attempting to recover stream len
WARNING: issue-143.pdf (object 1 0, offset 84): recovered stream length: 606
WARNING: issue-143.pdf object stream 1 (object 2 0, offset 33): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream
WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream
WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream
qpdf: operation succeeded with warnings; resulting file may have some problems