Merge pull request #1344 from m-holger/fuzz

Fix bugs found during fuzzing

Merge pull request #1344 from m-holger/fuzz
Fix bugs found during fuzzing
m-holger · GitHub
2 parents e324d36b 70f7af78
Showing 9 changed files with 11 additions and 2 deletions
fuzz/CMakeLists.txt
fuzz/qpdf_extra/376305073.fuzz
fuzz/qpdf_extra/389339260.fuzz
fuzz/qpdf_extra/389974979.fuzz
fuzz/qpdf_extra/391974927.fuzz
fuzz/qtest/fuzz.test
libqpdf/Pl_ASCII85Decoder.cc
libqpdf/QPDFOutlineObjectHelper.cc
libqpdf/qpdf/Pl_ASCII85Decoder.hh
@@ -146,7 +146,11 @@ set(CORPUS_OTHER
   99999e.fuzz
   369662293.fuzz
   369662293a.fuzz
+  376305073.fuzz
   377977949.fuzz
+  389339260.fuzz
+  389974979.fuzz
+  391974927.fuzz
 )
 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
@@ -11,7 +11,7 @@ my $td = new TestDriver(&#39;fuzz&#39;);
 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
-my $n_qpdf_files = 84;       # increment when adding new files
+my $n_qpdf_files = 88;       # increment when adding new files
 my @fuzzers = (
     ['ascii85' => 1],
@@ -58,6 +58,7 @@ Pl_ASCII85Decoder::write(unsigned char const* buf, size_t len)
             default:
                 if ((buf[i] < 33) || (buf[i] > 117)) {
+                    error = true;
                     throw std::runtime_error("character out of range during base 85 decode");
                 } else {
                     this->inbuf[this->pos++] = buf[i];
@@ -103,6 +104,9 @@ Pl_ASCII85Decoder::flush()
 void
 Pl_ASCII85Decoder::finish()
 {
+    if (error) {
+        return;
+    }
     flush();
     next()->finish();
 }
@@ -25,7 +25,7 @@ QPDFOutlineObjectHelper::QPDFOutlineObjectHelper(
     QPDFObjGen::set children;
     QPDFObjectHandle cur = oh.getKey("/First");
-    while (!cur.isNull() && children.add(cur)) {
+    while (!cur.isNull() && cur.isIndirect() && children.add(cur)) {
         QPDFOutlineObjectHelper new_ooh(cur, dh, 1 + depth);
         new_ooh.m->parent = std::make_shared<QPDFOutlineObjectHelper>(*this);
         m->kids.push_back(new_ooh);
@@ -17,6 +17,7 @@ class Pl_ASCII85Decoder final: public Pipeline
     unsigned char inbuf[5]{117, 117, 117, 117, 117};
     size_t pos{0};
     size_t eod{0};
+    bool error{false};
 };
 #endif // PL_ASCII85DECODER_HH