OpenSystemsDevelopment / qpdf

Commit 3ea83e9993801b002b4db8abaaa08dec31989ec7

Authored by m-holger
Committed by GitHub
2 parents 54cf0e51 64e98397

Merge pull request #1308 from m-holger/fuzz 

Validate key length in Pl_AES_PDF constructor
Inline Side-by-side
Showing 4 changed files with 5 additions and 1 deletions
fuzz/CMakeLists.txt
  View file @3ea83e9
... ... @@ -149,6 +149,7 @@ set(CORPUS_OTHER
149 149 99999e.fuzz
150 150 369662293.fuzz
151 151 369662293a.fuzz
  152 + 377977949.fuzz
152 153 )
153 154  
154 155 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
... ...
fuzz/qpdf_extra/377977949.fuzz 0 → 100644
View file @3ea83e9
No preview for this file type
fuzz/qtest/fuzz.test
  View file @3ea83e9
... ... @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
11 11  
12 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13  
14   -my $n_qpdf_files = 86; # increment when adding new files
  14 +my $n_qpdf_files = 87; # increment when adding new files
15 15  
16 16 my @fuzzers = (
17 17 ['ascii85' => 1],
... ...
libqpdf/Pl_AES_PDF.cc
  View file @3ea83e9
... ... @@ -23,6 +23,9 @@ Pl_AES_PDF::Pl_AES_PDF(
23 23 if (!next) {
24 24 throw std::logic_error("Attempt to create Pl_AES_PDF with nullptr as next");
25 25 }
  26 + if (!(key_bytes == 32 || key_bytes == 16)) {
  27 + throw std::runtime_error("unsupported key length");
  28 + }
26 29 this->key = std::make_unique<unsigned char[]>(key_bytes);
27 30 std::memcpy(this->key.get(), key, key_bytes);
28 31 std::memset(this->inbuf, 0, this->buf_size);
... ...