OpenSystemsDevelopment / qpdf

Commit 3ea83e9993801b002b4db8abaaa08dec31989ec7

Authored by m-holger
Committed by GitHub
2 parents 54cf0e51 64e98397

Merge pull request #1308 from m-holger/fuzz 

Validate key length in Pl_AES_PDF constructor
Inline Side-by-side
Showing 4 changed files with 5 additions and 1 deletions
fuzz/CMakeLists.txt
  View file @3ea83e9
@@ -149,6 +149,7 @@ set(CORPUS_OTHER @@ -149,6 +149,7 @@ set(CORPUS_OTHER
149 99999e.fuzz 149 99999e.fuzz
150 369662293.fuzz 150 369662293.fuzz
151 369662293a.fuzz 151 369662293a.fuzz
  152 + 377977949.fuzz
152 ) 153 )
153 154
154 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) 155 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
fuzz/qpdf_extra/377977949.fuzz 0 → 100644
View file @3ea83e9
No preview for this file type
fuzz/qtest/fuzz.test
  View file @3ea83e9
@@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz'); @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
11 11
12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS"; 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13
14 -my $n_qpdf_files = 86; # increment when adding new files 14 +my $n_qpdf_files = 87; # increment when adding new files
15 15
16 my @fuzzers = ( 16 my @fuzzers = (
17 ['ascii85' => 1], 17 ['ascii85' => 1],
libqpdf/Pl_AES_PDF.cc
  View file @3ea83e9
@@ -23,6 +23,9 @@ Pl_AES_PDF::Pl_AES_PDF( @@ -23,6 +23,9 @@ Pl_AES_PDF::Pl_AES_PDF(
23 if (!next) { 23 if (!next) {
24 throw std::logic_error("Attempt to create Pl_AES_PDF with nullptr as next"); 24 throw std::logic_error("Attempt to create Pl_AES_PDF with nullptr as next");
25 } 25 }
  26 + if (!(key_bytes == 32 || key_bytes == 16)) {
  27 + throw std::runtime_error("unsupported key length");
  28 + }
26 this->key = std::make_unique<unsigned char[]>(key_bytes); 29 this->key = std::make_unique<unsigned char[]>(key_bytes);
27 std::memcpy(this->key.get(), key, key_bytes); 30 std::memcpy(this->key.get(), key, key_bytes);
28 std::memset(this->inbuf, 0, this->buf_size); 31 std::memset(this->inbuf, 0, this->buf_size);