Detect stream in object stream, fixing fuzz 16214

It's detected in QPDFWriter instead of at parse time because I can't figure out how to construct a test case in a reasonable time. This commit moves the fuzz file into the regular test suite for a QTC coverage case.

Detect stream in object stream, fixing fuzz 16214
It's detected in QPDFWriter instead of at parse time because I can't figure out how to construct a test case in a reasonable time. This commit moves the fuzz file into the regular test suite for a QTC coverage case.
Jay Berkenbilt
1 parent 15248aa5
Showing 8 changed files with 44 additions and 5 deletions
fuzz/build.mk
fuzz/qtest/fuzz.test
libqpdf/QPDFWriter.cc
libqpdf/QPDF_Stream.cc
qpdf/qpdf.testcov
qpdf/qtest/qpdf.test
qpdf/qtest/qpdf/fuzz-16214.out
qpdf/qtest/qpdf/fuzz-16214.pdf
@@ -41,6 +41,7 @@ CORPUS_FROM_TEST = \
 	outlines-with-old-root-dests.pdf \
 	page-labels-and-outlines.pdf \
 	page-labels-num-tree.pdf \
+	fuzz-16214.pdf \
 	issue-99b.pdf \
 	issue-99.pdf \
 	issue-100.pdf \
@@ -9,7 +9,7 @@ require TestDriver;
 my $td = new TestDriver('fuzz');
-my $qpdf_n_test_files = 29;
+my $qpdf_n_test_files = 30;
 my @extra = glob("../qpdf_extra/*.fuzz");
 my $qpdf_n_extra_files = scalar(@extra);
 my $qpdf_n_orig_files = 2559;
@@ -2012,7 +2012,19 @@ QPDFWriter::writeObjectStream(QPDFObjectHandle object)
                 // pass 1.
                 indicateProgress(true, false);
 	    }
-	    writeObject(this->m->pdf.getObjectByObjGen(obj), count);
+            QPDFObjectHandle obj_to_write =
+                this->m->pdf.getObjectByObjGen(obj);
+            if (obj_to_write.isStream())
+            {
+                // This condition occurred in a fuzz input. Ideally we
+                // should block it at at parse time, but it's not
+                // clear to me how to construct a case for this.
+                QTC::TC("qpdf", "QPDFWriter stream in ostream");
+                obj_to_write.warnIfPossible(
+                    "stream found inside object stream; treating as null");
+                obj_to_write = QPDFObjectHandle::newNull();
+            }
+	    writeObject(obj_to_write, count);
 	    this->m->xref[new_obj] = QPDFXRefEntry(2, new_id, count);
 	}
@@ -105,7 +105,8 @@ QPDF_Stream::setStreamDescription()
 {
     setDescription(
         this->qpdf,
-        "stream object " + QUtil::int_to_string(this->objid) + " " +
+        this->qpdf->getFilename() +
+        ", stream object " + QUtil::int_to_string(this->objid) + " " +
         QUtil::int_to_string(this->generation));
 }
@@ -444,3 +444,4 @@ QPDF xref skipped space 0
 QPDF eof skipping spaces before xref 1
 QPDF_encryption user matches owner V < 5 0
 QPDF_encryption same password 1
+QPDFWriter stream in ostream 0
@@ -643,6 +643,7 @@ my @bug_tests = (
     ["263", "empty xref stream", 2],
     ["335a", "ozz-fuzz-12152", 2],
     ["335b", "ozz-fuzz-14845", 2],
+    ["fuzz-16214", "stream in object stream", 3],
     # When adding to this list, consider adding to SEED_CORPUS_FILES
     # in fuzz/build.mk and updating the count in fuzz/qtest/fuzz.test.
     );
@@ -669,9 +670,10 @@ foreach my $d (@bug_tests)
     }
     else
     {
+        my $base = (-f "issue-$n.pdf") ? "issue-$n" : "$n";
         $td->runtest($description,
-                     {$td->COMMAND => "qpdf issue-$n.pdf a.pdf"},
-                     {$td->FILE => "issue-$n.out",
+                     {$td->COMMAND => "qpdf $base.pdf a.pdf"},
+                     {$td->FILE => "$base.out",
                           $td->EXIT_STATUS => $exit_status},
                      $td->NORMALIZE_NEWLINES);
     }
+WARNING: fuzz-16214.pdf: can't find PDF header
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 124): stream dictionary lacks /Length key
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 353): attempting to recover stream length
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 353): recovered stream length: 722
+WARNING: fuzz-16214.pdf (xref stream, offset 116): Cross-reference stream data has the wrong size; expected = 92; actual = 196
+WARNING: fuzz-16214.pdf: reported number of objects (6) is not one plus the highest object number (35)
+WARNING: fuzz-16214.pdf (object 14 0, offset 652): expected dictionary key but found non-name object; inserting key /QPDFFake1
+WARNING: fuzz-16214.pdf (object 14 0, offset 734): expected endobj
+WARNING: fuzz-16214.pdf: file is damaged
+WARNING: fuzz-16214.pdf (object 1 0, offset 7189): expected n n obj
+WARNING: fuzz-16214.pdf: Attempting to reconstruct cross-reference table
+WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
+WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
+WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
+WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
+WARNING: fuzz-16214.pdf (object 11 0, offset 11551): supposed object stream 5 has wrong type
+WARNING: fuzz-16214.pdf (object 21 0, offset 3639): expected endstream
+WARNING: fuzz-16214.pdf (object 21 0, offset 3112): attempting to recover stream length
+WARNING: fuzz-16214.pdf (object 21 0, offset 3112): recovered stream length: 340
+WARNING: fuzz-16214.pdf, stream object 8 0: stream found inside object stream; treating as null
+WARNING: fuzz-16214.pdf, stream object 8 0: stream found inside object stream; treating as null
+qpdf: operation succeeded with warnings; resulting file may have some problems