octoleo/qpdf
2
1
Fork 0
mirror of https://github.com/qpdf/qpdf.git synced 2024-10-18 01:46:27 +00:00
Code Issues Releases Wiki Activity

Merge pull request #1251 from m-holger/fuzz

Browse Source 
Mark intentional unsigned integer wrapping in MD5_native::transform and adjust fuzzer memory limits
This commit is contained in:
m-holger 2024-07-23 00:22:31 +01:00 committed by GitHub
commit fa9df75bd4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fuzz/qpdf_fuzzer.cc
View File

@ -181,8 +181,8 @@ FuzzHelper::doChecks()
// occur legitimately and therefore must be allowed during normal operations. // occur legitimately and therefore must be allowed during normal operations.
Pl_DCT::setMemoryLimit(1'000'000'000); Pl_DCT::setMemoryLimit(1'000'000'000);
Pl_PNGFilter::setMemoryLimit(1'000'000'000); Pl_PNGFilter::setMemoryLimit(1'000'000);
Pl_TIFFPredictor::setMemoryLimit(1'000'000'000); Pl_TIFFPredictor::setMemoryLimit(1'000'000);
// Do not decompress corrupt data. This may cause extended runtime within jpeglib without // Do not decompress corrupt data. This may cause extended runtime within jpeglib without
// exercising additional code paths in qpdf, and potentially causing counterproductive timeouts. // exercising additional code paths in qpdf, and potentially causing counterproductive timeouts.

5
libqpdf/MD5_native.cc
View File

@ -193,7 +193,12 @@ MD5_native::digest(Digest result)
} }
// MD5 basic transformation. Transforms state based on block. // MD5 basic transformation. Transforms state based on block.
//
// NB The algorithm intentionally relies on unsigned integer wrap-around
void MD5_native::transform(uint32_t state[4], unsigned char block[64]) void MD5_native::transform(uint32_t state[4], unsigned char block[64])
#if defined(__clang__)
__attribute__((no_sanitize("unsigned-integer-overflow")))
#endif
{ {
uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[16]; uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[16];