OpenSystemsDevelopment / qpdf

Commit 059d9a9b1180acf7a0e37c6fd7a42e92697da465

Authored by m-holger
Committed by GitHub
2 parents 7e9c6c74 6dfdc404

Merge pull request #1525 from m-holger/fuzz 

Validate existence of array items in `NNTree`, improve null handling,…
Inline Side-by-side
Showing 4 changed files with 10 additions and 3 deletions
fuzz/CMakeLists.txt
  View file @059d9a9
... ... @@ -159,6 +159,7 @@ set(CORPUS_OTHER
159 159 409905355.fuzz
160 160 411312393.fuzz
161 161 433311400.fuzz
  162 + 4720043549327360.fuzz
162 163 5109284021272576.fuzz
163 164 6489005569146880.fuzz
164 165 )
... ...
fuzz/qpdf_extra/4720043549327360.fuzz 0 → 100644
View file @059d9a9
No preview for this file type
fuzz/qtest/fuzz.test
  View file @059d9a9
... ... @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
11 11  
12 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13  
14   -my $n_qpdf_files = 98; # increment when adding new files
  14 +my $n_qpdf_files = 99; # increment when adding new files
15 15  
16 16 my @fuzzers = (
17 17 ['ascii85' => 1],
... ...
libqpdf/NNTree.cc
  View file @059d9a9
... ... @@ -139,6 +139,8 @@ NNTreeIterator::increment(bool backward)
139 139 impl.warn(node, "items array doesn't have enough elements");
140 140 } else if (!impl.details.keyValid(items[item_number])) {
141 141 impl.warn(node, ("item " + std::to_string(item_number) + " has the wrong type"));
  142 + } else if (!items[item_number + 1]) {
  143 + impl.warn(node, "item " + std::to_string(item_number) + " is null");
142 144 } else {
143 145 return;
144 146 }
... ... @@ -734,8 +736,12 @@ NNTreeImpl::repair()
734 736 auto new_node = QPDFObjectHandle::newDictionary();
735 737 new_node.replaceKey(details.itemsKey(), Array());
736 738 NNTreeImpl repl(details, qpdf, new_node, false);
737   - for (auto const& i: *this) {
738   - repl.insert(i.first, i.second);
  739 + for (auto const& [key, value]: *this) {
  740 +// if (key && value) {
  741 + repl.insert(key, value);
  742 +// } else {
  743 +// std::cerr << key.unparse() << "\n";
  744 +// }
739 745 }
740 746 oh.replaceKey("/Kids", new_node.getKey("/Kids"));
741 747 oh.replaceKey(details.itemsKey(), new_node.getKey(details.itemsKey()));
... ...