diff --git a/TODO b/TODO index 092dfe1f..cd6f4c88 100644 --- a/TODO +++ b/TODO @@ -1,9 +1,6 @@ Candidates for upcoming release =============================== -* Fuzz crashes - * See "New" below - * Open "next" issues * bugs * #473: zsh completion with directories @@ -64,9 +61,6 @@ Fuzz Errors * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id= -* New: - * 23642: leak: https://oss-fuzz.com/testcase-detail/4906569690251264 - * Ignoring these: * Problems inside the jpeg library: 15470, 15751, 18633, 18732, 18745, 20391, 23581 diff --git a/fuzz/qpdf_extra/23642-mod.fuzz b/fuzz/qpdf_extra/23642-mod.fuzz new file mode 100644 index 00000000..af22a59b --- /dev/null +++ b/fuzz/qpdf_extra/23642-mod.fuzz @@ -0,0 +1,176 @@ +%PDF-1.6 % +213 0 obj <>stream +202 0 201 128 200 207 197 272 196 326 195 363 198 428 199 524 <><><>[/DeviceN[/Magenta/Yellow]/DeviceCMYK 183 0 R 196 0 R]<><><><> +endstream endobj 214 0 obj <>stream +176 0 <> +endstream endobj 215 0 obj <>stream +7 0 9 100 22 132 23 206 110 262 118 311 111 332 117 377 112 398 116 443 113 464 114 518 115 539 24 560 70 724 109 773 71 793 108 842 72 862 107 911 73 931 106 980 74 1000 105 1049 75 1069 104 1118 76 1138 103 1187 77 1207 102 1256 78 1276 101 1325 79 1345 100 1394 80 1414 99 1462 81 1482 98 1530 82 1550 97 1598 83 1618 96 1666 84 1686 95 1734 85 1754 94 1802 86 1822 93 1870 87 1890 92 1938 88 1958 91 2006 89 2026 90 2074 25 2094 43 2124 44 2175 45 2250 46 2296 67 2323 68 2350 69 2386 47 2406 64 2433 65 2460 66 2496 48 2516 61 2543 62 2570 63 2606 49 2626 58 2653 59 2680 60 2716 50 2736 55 2763 56 2790 57 2826 51 2846 52 2873 53 2900 54 2936 26 2956 38 2994 41 3037 42 3057 39 3077 40 3112 27 3132 33 3170 37 3205 34 3225 35 3268 36 3288 28 3308 29 3346 32 3381 30 3401 31 3436 21 3456 119 3599 120 3656 121 3714 140 3776 122 3820 123 3878 139 3950 124 3994 138 4066 125 4110 137 4172 126 4216 127 4274 136 4346 128 4390 129 4448 135 4520 1 304564 134 4626 131 4670 132 4728 133 4838 15 4882 16 4927 17 4972 18 5017 20 5062 141 5165 19 5208 12 5252 14 5296 10 5340 11 27336 8 27684 142 28104 143 28133 144 28162 145 28190 146 28218 147 28247 148 28276 149 28304 150 28332 151 28360 152 28422 153 28484 154 28528 155 28572 156 28616 157 28678 158 28740 159 28802 160 28864 161 28910 162 28971 163 29033 164 29111 165 29173 166 29235 167 29296 168 29357 169 29403 170 29448 171 29477 172 29537 173 29580 174 29657 175 29719 <><><><><><

><><

><><

><><

><

><><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><

><><><><><><><><

><><><><

><><><><

><><><><

><><><><

><><><><

><><><

><

><><

><><><

><><

><

><><><

><><

><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> +endstream endobj 216 0 obj <>stream +177 0 <> +endstream endobj 217 0 obj <>stream +180 0 <>/ExtGState<>/Properties<>/Shading<>>>/Rotate 0/StructParents 0/TrimBox[0.0 0.0 612.0 792.0]/Type/Page>> +endstream endobj 3 0 obj <>stream + + + + + 2011-12-28T21:19:19-08:00 + 2011-12-28T21:14:04-08:00 + 2011-12-28T21:19:19-08:00 + Adobe InDesign CS3 (5.0.4) + + + application/pdf + + + uuid:845b3671-d5d9-4fea-8364-35f908dab081 + uuid:a82bfde6-db89-4e3c-b234-cc4f479eee5e + + + Adobe PDF Library 8.0 + + + + + + + + + + + + + + + + + + + + + + + + + +endstream endobj 179 0 obj <>/Metadata 3 0 R/Pages 176 0 R/StructTreeRoot 7 0 R/Type/Catalog>> endobj 183 0 obj <>stream +H63cC ZI.+RHHP(.MB(3*"3]t9.f0*QrM4iLr3  `PR +endstream endobj 184 0 obj <>stream + + + uuid:8393369E62D1DF11BFA5F1EA9E890599 + uuid:3CCEE6BD22D6DF11825585EB36650B70 + + uuid:216EC71795AB11DFBB39EAAFE7FAF251 + uuid:216EC71695AB11DFBB39EAAFE7FAF251 + + + + Print + + + 1 + False + False + + 11.000000 + 8.500000 + Inches + + + + + SymantecSansMedium + Symantec Sans Medium + Regular + Open Type + Version 1.00 + False + SAMD__.otf + + + + + + Black + + + + + + Default Swatch Group + 0 + + + + White + CMYK + PROCESS + 0.000000 + 0.000000 + 0.000000 + 0.000000 + + + C=0 M=0 Y=0 K=100 + PROCESS + 100.000000 + CMYK + 0.000000 + 0.000000 + 0.000000 + 100.000000 + + + c0m25y100k0 + PROCESS + 100.000000 + CMYK + 0.000000 + 25.000000 + 100.000000 + 0.000000 + + + R=142 G=144 B=143 + CMYK + PROCESS + 28.627396 + 20.784301 + 21.568596 + 29.411799 + + + + + + + + + + +endstream endobj 212 0 obj <>stream +H]kQs^|9]BAiŋBQ0& Z/(»gàWyM,_ЃT(=d׏e7=䚷'6/B4ڸ-$bvѦ9gogwM\b:$%p'DdyOvt[=MiS5xmg~vټRʃ"ѰHI \ڟjuޖ9 ymgJљTDa +p~goզmd2~MžMyzJ>Oxx\mb`uNp88`c{$]`c{$;06el=KrdIlx;Kd%Gs`SS`IwRb?śXMb5?Ob?~EOƫ]tT~׋9<07981B59180B1148A662CE69B13E7098>]/Info 177 0 R/Length 876/Root 179 0 R/Size 219/Type/XRef/W[1 2 1]>>stream +ׅ׃ׁׂׄz{|}׀~c 6RX^_ab`Y[\]ZSVWTU789:>BFJNOPQKLMGHICDE?@A;<= "$&(*,.024531/-+)'%#! +   defhikmoprsuwxyvtqnljg׆ׇ׈׉׊׋׌׍׎׏אבגדהוזחטיךכלםמןנסעףפץצקFy0}Y~; +endstream endobj startxref +44161 +%%EOF diff --git a/fuzz/qpdf_extra/23642.fuzz b/fuzz/qpdf_extra/23642.fuzz new file mode 100644 index 00000000..c44202d7 Binary files /dev/null and b/fuzz/qpdf_extra/23642.fuzz differ diff --git a/include/qpdf/QPDF.hh b/include/qpdf/QPDF.hh index 2482b232..285ba1e3 100644 --- a/include/qpdf/QPDF.hh +++ b/include/qpdf/QPDF.hh @@ -1403,6 +1403,7 @@ class QPDF bool immediate_copy_from; bool in_parse; bool parsed; + std::set resolved_object_streams; // Linearization data qpdf_offset_t first_xref_item_offset; // actual value from file diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index 2ffd4cc6..d256e444 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -2082,6 +2082,11 @@ QPDF::resolve(int objid, int generation) void QPDF::resolveObjectsInStream(int obj_stream_number) { + if (this->m->resolved_object_streams.count(obj_stream_number)) + { + return; + } + this->m->resolved_object_streams.insert(obj_stream_number); // Force resolution of object stream QPDFObjectHandle obj_stream = getObjectByID(obj_stream_number, 0); if (! obj_stream.isStream()) diff --git a/qpdf/qtest/qpdf/fuzz-16214.out b/qpdf/qtest/qpdf/fuzz-16214.out index 55862b1a..2c3be302 100644 --- a/qpdf/qtest/qpdf/fuzz-16214.out +++ b/qpdf/qtest/qpdf/fuzz-16214.out @@ -11,8 +11,6 @@ WARNING: fuzz-16214.pdf (object 1 0, offset 7189): expected n n obj WARNING: fuzz-16214.pdf: Attempting to reconstruct cross-reference table WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream -WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set -WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream WARNING: fuzz-16214.pdf (object 11 0, offset 11551): supposed object stream 5 has wrong type WARNING: fuzz-16214.pdf (object 21 0, offset 3639): expected endstream WARNING: fuzz-16214.pdf (object 21 0, offset 3112): attempting to recover stream length diff --git a/qpdf/qtest/qpdf/issue-143.out b/qpdf/qtest/qpdf/issue-143.out index bded2e00..b09eea3b 100644 --- a/qpdf/qtest/qpdf/issue-143.out +++ b/qpdf/qtest/qpdf/issue-143.out @@ -15,6 +15,4 @@ WARNING: issue-143.pdf (object 1 0, offset 84): attempting to recover stream len WARNING: issue-143.pdf (object 1 0, offset 84): recovered stream length: 606 WARNING: issue-143.pdf object stream 1 (object 2 0, offset 33): expected dictionary key but found non-name object; inserting key /QPDFFake1 WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream -WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream -WARNING: issue-143.pdf (object 2 0, offset 84): supposed object stream 12336 is not a stream qpdf: operation succeeded with warnings; resulting file may have some problems