diff --git a/fuzz/CMakeLists.txt b/fuzz/CMakeLists.txt index 05a23bd..ee54fa7 100644 --- a/fuzz/CMakeLists.txt +++ b/fuzz/CMakeLists.txt @@ -99,6 +99,7 @@ set(CORPUS_OTHER 16301.fuzz 16953.fuzz 17630.fuzz + 17630a.fuzz 18241.fuzz 18247.fuzz 23172.fuzz @@ -129,7 +130,6 @@ set(CORPUS_OTHER 70055.fuzz 70245.fuzz 70306.fuzz - 4826608268017664.fuzz ) set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus) diff --git a/fuzz/qpdf_extra/4826608268017664.fuzz b/fuzz/qpdf_extra/17630a.fuzz index 2ae60ff..2ae60ff 100644 --- a/fuzz/qpdf_extra/4826608268017664.fuzz +++ b/fuzz/qpdf_extra/17630a.fuzz diff --git a/fuzz/qpdf_fuzzer.cc b/fuzz/qpdf_fuzzer.cc index 20073d2..3486c1b 100644 --- a/fuzz/qpdf_fuzzer.cc +++ b/fuzz/qpdf_fuzzer.cc @@ -2,6 +2,8 @@ #include #include #include +#include +#include #include #include #include @@ -57,7 +59,7 @@ FuzzHelper::getQpdf() auto is = std::shared_ptr(new BufferInputSource("fuzz input", &this->input_buffer)); auto qpdf = QPDF::create(); - qpdf->setMaxWarnings(20); + qpdf->setMaxWarnings(500); qpdf->processInputSource(is); return qpdf; } @@ -179,6 +181,9 @@ FuzzHelper::doChecks() // occur legitimately and therefore must be allowed during normal operations. Pl_DCT::setMemoryLimit(1'000'000'000); + Pl_PNGFilter::setMemoryLimit(1'000'000'000); + Pl_TIFFPredictor::setMemoryLimit(1'000'000'000); + // Do not decompress corrupt data. This may cause extended runtime within jpeglib without // exercising additional code paths in qpdf, and potentially causing counterproductive timeouts. Pl_DCT::setThrowOnCorruptData(true); diff --git a/include/qpdf/QPDF.hh b/include/qpdf/QPDF.hh index a57925a..a79c0dc 100644 --- a/include/qpdf/QPDF.hh +++ b/include/qpdf/QPDF.hh @@ -228,9 +228,9 @@ class QPDF QPDF_DLL void setSuppressWarnings(bool); - // Set the maximum number of warnings to output. Subsequent warnings are suppressed. + // Set the maximum number of warnings. A QPDFExc is thrown if the limit is exceeded. QPDF_DLL - void setMaxWarnings(int); + void setMaxWarnings(size_t); // By default, QPDF will try to recover if it finds certain types of errors in PDF files. If // turned off, it will throw an exception on the first such problem it finds without attempting @@ -1501,7 +1501,7 @@ class QPDF bool provided_password_is_hex_key{false}; bool ignore_xref_streams{false}; bool suppress_warnings{false}; - int max_warnings{0}; + size_t max_warnings{0}; bool attempt_recovery{true}; bool check_mode{false}; std::shared_ptr encp; diff --git a/libqpdf/Pl_PNGFilter.cc b/libqpdf/Pl_PNGFilter.cc index 4c2dd62..4d2bc71 100644 --- a/libqpdf/Pl_PNGFilter.cc +++ b/libqpdf/Pl_PNGFilter.cc @@ -7,6 +7,11 @@ #include #include +namespace +{ + unsigned long long memory_limit{0}; +} // namespace + static int abs_diff(int a, int b) { @@ -41,6 +46,9 @@ Pl_PNGFilter::Pl_PNGFilter( if ((bpr == 0) || (bpr > (UINT_MAX - 1))) { throw std::runtime_error("PNGFilter created with invalid columns value"); } + if (memory_limit > 0 && bpr > (memory_limit / 2U)) { + throw std::runtime_error("PNGFilter memory limit exceeded"); + } this->bytes_per_row = bpr & UINT_MAX; this->buf1 = QUtil::make_shared_array(this->bytes_per_row + 1); this->buf2 = QUtil::make_shared_array(this->bytes_per_row + 1); @@ -54,6 +62,12 @@ Pl_PNGFilter::Pl_PNGFilter( } void +Pl_PNGFilter::setMemoryLimit(unsigned long long limit) +{ + memory_limit = limit; +} + +void Pl_PNGFilter::write(unsigned char const* data, size_t len) { size_t left = this->incoming - this->pos; diff --git a/libqpdf/Pl_TIFFPredictor.cc b/libqpdf/Pl_TIFFPredictor.cc index ec47704..c2cc856 100644 --- a/libqpdf/Pl_TIFFPredictor.cc +++ b/libqpdf/Pl_TIFFPredictor.cc @@ -7,6 +7,11 @@ #include #include +namespace +{ + unsigned long long memory_limit{0}; +} // namespace + Pl_TIFFPredictor::Pl_TIFFPredictor( char const* identifier, Pipeline* next, @@ -31,10 +36,19 @@ Pl_TIFFPredictor::Pl_TIFFPredictor( if ((bpr == 0) || (bpr > (UINT_MAX - 1))) { throw std::runtime_error("TIFFPredictor created with invalid columns value"); } + if (memory_limit > 0 && bpr > (memory_limit / 2U)) { + throw std::runtime_error("TIFFPredictor memory limit exceeded"); + } this->bytes_per_row = bpr & UINT_MAX; } void +Pl_TIFFPredictor::setMemoryLimit(unsigned long long limit) +{ + memory_limit = limit; +} + +void Pl_TIFFPredictor::write(unsigned char const* data, size_t len) { auto end = data + len; diff --git a/libqpdf/QPDF.cc b/libqpdf/QPDF.cc index 88373cb..768dc5f 100644 --- a/libqpdf/QPDF.cc +++ b/libqpdf/QPDF.cc @@ -332,7 +332,7 @@ QPDF::setSuppressWarnings(bool val) } void -QPDF::setMaxWarnings(int val) +QPDF::setMaxWarnings(size_t val) { m->max_warnings = val; } @@ -504,13 +504,11 @@ QPDF::inParse(bool v) void QPDF::warn(QPDFExc const& e) { + if (m->max_warnings > 0 && m->warnings.size() >= m->max_warnings) { + stopOnError("Too many warnings - file is too badly damaged"); + } m->warnings.push_back(e); if (!m->suppress_warnings) { - if (m->max_warnings > 0 && m->warnings.size() > 20) { - *m->log->getWarn() << "WARNING: too many warnings - additional warnings suppressed\n"; - m->suppress_warnings = true; - return; - } *m->log->getWarn() << "WARNING: " << m->warnings.back().what() << "\n"; } } diff --git a/libqpdf/QPDF_json.cc b/libqpdf/QPDF_json.cc index ffdd711..30aca25 100644 --- a/libqpdf/QPDF_json.cc +++ b/libqpdf/QPDF_json.cc @@ -233,13 +233,12 @@ provide_data(std::shared_ptr is, qpdf_offset_t start, qpdf_offset_t class QPDF::JSONReactor: public JSON::Reactor { public: - JSONReactor(QPDF& pdf, std::shared_ptr is, bool must_be_complete, int max_warnings) : + JSONReactor(QPDF& pdf, std::shared_ptr is, bool must_be_complete) : pdf(pdf), is(is), must_be_complete(must_be_complete), descr(std::make_shared( - QPDFValue::JSON_Descr(std::make_shared(is->getName()), ""))), - max_warnings(max_warnings) + QPDFValue::JSON_Descr(std::make_shared(is->getName()), ""))) { for (auto& oc: pdf.m->obj_cache) { if (oc.second.object->getTypeCode() == ::ot_reserved) { @@ -292,8 +291,7 @@ class QPDF::JSONReactor: public JSON::Reactor std::shared_ptr is; bool must_be_complete{true}; std::shared_ptr descr; - int errors{0}; - int max_warnings{0}; + bool errors{false}; bool saw_qpdf{false}; bool saw_qpdf_meta{false}; bool saw_objects{false}; @@ -316,21 +314,18 @@ class QPDF::JSONReactor: public JSON::Reactor void QPDF::JSONReactor::error(qpdf_offset_t offset, std::string const& msg) { - ++errors; + errors = true; std::string object = this->cur_object; if (is->getName() != pdf.getFilename()) { object += " from " + is->getName(); } - this->pdf.warn(qpdf_e_json, object, offset, msg); - if (max_warnings > 0 && errors >= max_warnings) { - throw std::runtime_error("errors found in JSON"); - } + pdf.warn(qpdf_e_json, object, offset, msg); } bool QPDF::JSONReactor::anyErrors() const { - return errors > 0; + return errors; } void @@ -825,7 +820,7 @@ QPDF::updateFromJSON(std::shared_ptr is) void QPDF::importJSON(std::shared_ptr is, bool must_be_complete) { - JSONReactor reactor(*this, is, must_be_complete, m->max_warnings); + JSONReactor reactor(*this, is, must_be_complete); try { JSON::parse(*is, &reactor); } catch (std::runtime_error& e) { diff --git a/libqpdf/qpdf/Pl_PNGFilter.hh b/libqpdf/qpdf/Pl_PNGFilter.hh index ed8e1e9..9f1950e 100644 --- a/libqpdf/qpdf/Pl_PNGFilter.hh +++ b/libqpdf/qpdf/Pl_PNGFilter.hh @@ -24,6 +24,10 @@ class Pl_PNGFilter: public Pipeline unsigned int bits_per_sample = 8); ~Pl_PNGFilter() override = default; + // Limit the memory used. + // NB This is a static option affecting all Pl_PNGFilter instances. + static void setMemoryLimit(unsigned long long limit); + void write(unsigned char const* data, size_t len) override; void finish() override; diff --git a/libqpdf/qpdf/Pl_TIFFPredictor.hh b/libqpdf/qpdf/Pl_TIFFPredictor.hh index 3f448f1..4e32936 100644 --- a/libqpdf/qpdf/Pl_TIFFPredictor.hh +++ b/libqpdf/qpdf/Pl_TIFFPredictor.hh @@ -22,6 +22,10 @@ class Pl_TIFFPredictor: public Pipeline unsigned int bits_per_sample = 8); ~Pl_TIFFPredictor() override = default; + // Limit the memory used. + // NB This is a static option affecting all Pl_TIFFPredictor instances. + static void setMemoryLimit(unsigned long long limit); + void write(unsigned char const* data, size_t len) override; void finish() override;