mirror of
https://github.com/qpdf/qpdf.git
synced 2025-02-12 00:28:31 +00:00
671b6e2ecf
Fixes oss-fuzz case 394129398. Issue arose from chaining multiple runlength filters and inflating a compressed stream of ~100 bytes to several gigabytes. There is no obvious fix without imposing an arbitrary implementation limit and therefore potentially excluding valid PDF files.
52 lines
939 B
C++
52 lines
939 B
C++
#include <qpdf/Pl_Discard.hh>
|
|
#include <qpdf/Pl_RunLength.hh>
|
|
#include <iostream>
|
|
#include <stdexcept>
|
|
|
|
class FuzzHelper
|
|
{
|
|
public:
|
|
FuzzHelper(unsigned char const* data, size_t size);
|
|
void run();
|
|
|
|
private:
|
|
void doChecks();
|
|
|
|
unsigned char const* data;
|
|
size_t size;
|
|
};
|
|
|
|
FuzzHelper::FuzzHelper(unsigned char const* data, size_t size) :
|
|
data(data),
|
|
size(size)
|
|
{
|
|
}
|
|
|
|
void
|
|
FuzzHelper::doChecks()
|
|
{
|
|
Pl_RunLength::setMemoryLimit(1'000'000);
|
|
Pl_Discard discard;
|
|
Pl_RunLength p("decode", &discard, Pl_RunLength::a_decode);
|
|
p.write(const_cast<unsigned char*>(data), size);
|
|
p.finish();
|
|
}
|
|
|
|
void
|
|
FuzzHelper::run()
|
|
{
|
|
try {
|
|
doChecks();
|
|
} catch (std::runtime_error const& e) {
|
|
std::cerr << "runtime_error: " << e.what() << std::endl;
|
|
}
|
|
}
|
|
|
|
extern "C" int
|
|
LLVMFuzzerTestOneInput(unsigned char const* data, size_t size)
|
|
{
|
|
FuzzHelper f(data, size);
|
|
f.run();
|
|
return 0;
|
|
}
|