Merge pull request #1247 from m-holger/fuzz

Adjust fuzzer warning and memory limits

Merge pull request #1247 from m-holger/fuzz
Adjust fuzzer warning and memory limits
m-holger · GitHub
2 parents 9ac50650 30e187b4
Showing 10 changed files with 57 additions and 23 deletions
fuzz/CMakeLists.txt
fuzz/qpdf_extra/4826608268017664.fuzz → fuzz/qpdf_extra/17630a.fuzz
fuzz/qpdf_fuzzer.cc
include/qpdf/QPDF.hh
libqpdf/Pl_PNGFilter.cc
libqpdf/Pl_TIFFPredictor.cc
libqpdf/QPDF.cc
libqpdf/QPDF_json.cc
libqpdf/qpdf/Pl_PNGFilter.hh
libqpdf/qpdf/Pl_TIFFPredictor.hh
@@ -99,6 +99,7 @@ set(CORPUS_OTHER
   16301.fuzz
   16953.fuzz
   17630.fuzz
+  17630a.fuzz
   18241.fuzz
   18247.fuzz
   23172.fuzz
@@ -129,7 +130,6 @@ set(CORPUS_OTHER
   70055.fuzz
   70245.fuzz
   70306.fuzz
-  4826608268017664.fuzz
 )
 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
@@ -2,6 +2,8 @@
 #include <qpdf/BufferInputSource.hh>
 #include <qpdf/Pl_DCT.hh>
 #include <qpdf/Pl_Discard.hh>
+#include <qpdf/Pl_PNGFilter.hh>
+#include <qpdf/Pl_TIFFPredictor.hh>
 #include <qpdf/QPDF.hh>
 #include <qpdf/QPDFAcroFormDocumentHelper.hh>
 #include <qpdf/QPDFOutlineDocumentHelper.hh>
@@ -57,7 +59,7 @@ FuzzHelper::getQpdf()
     auto is =
         std::shared_ptr<InputSource>(new BufferInputSource("fuzz input", &this->input_buffer));
     auto qpdf = QPDF::create();
-    qpdf->setMaxWarnings(20);
+    qpdf->setMaxWarnings(500);
     qpdf->processInputSource(is);
     return qpdf;
 }
@@ -179,6 +181,9 @@ FuzzHelper::doChecks()
     // occur legitimately and therefore must be allowed during normal operations.
     Pl_DCT::setMemoryLimit(1'000'000'000);
+    Pl_PNGFilter::setMemoryLimit(1'000'000'000);
+    Pl_TIFFPredictor::setMemoryLimit(1'000'000'000);
+
     // Do not decompress corrupt data. This may cause extended runtime within jpeglib without
     // exercising additional code paths in qpdf, and potentially causing counterproductive timeouts.
     Pl_DCT::setThrowOnCorruptData(true);
@@ -228,9 +228,9 @@ class QPDF
     QPDF_DLL
     void setSuppressWarnings(bool);
-    // Set the maximum number of warnings to output. Subsequent warnings are suppressed.
+    // Set the maximum number of warnings. A QPDFExc is thrown if the limit is exceeded.
     QPDF_DLL
-    void setMaxWarnings(int);
+    void setMaxWarnings(size_t);
     // By default, QPDF will try to recover if it finds certain types of errors in PDF files.  If
     // turned off, it will throw an exception on the first such problem it finds without attempting
@@ -1501,7 +1501,7 @@ class QPDF
         bool provided_password_is_hex_key{false};
         bool ignore_xref_streams{false};
         bool suppress_warnings{false};
-        int max_warnings{0};
+        size_t max_warnings{0};
         bool attempt_recovery{true};
         bool check_mode{false};
         std::shared_ptr<EncryptionParameters> encp;
@@ -7,6 +7,11 @@
 #include <cstring>
 #include <stdexcept>
+namespace
+{
+    unsigned long long memory_limit{0};
+} // namespace
+
 static int
 abs_diff(int a, int b)
 {
@@ -41,6 +46,9 @@ Pl_PNGFilter::Pl_PNGFilter(
     if ((bpr == 0) || (bpr > (UINT_MAX - 1))) {
         throw std::runtime_error("PNGFilter created with invalid columns value");
     }
+    if (memory_limit > 0 && bpr > (memory_limit / 2U)) {
+        throw std::runtime_error("PNGFilter memory limit exceeded");
+    }
     this->bytes_per_row = bpr & UINT_MAX;
     this->buf1 = QUtil::make_shared_array<unsigned char>(this->bytes_per_row + 1);
     this->buf2 = QUtil::make_shared_array<unsigned char>(this->bytes_per_row + 1);
@@ -54,6 +62,12 @@ Pl_PNGFilter::Pl_PNGFilter(
 }
 void
+Pl_PNGFilter::setMemoryLimit(unsigned long long limit)
+{
+    memory_limit = limit;
+}
+
+void
 Pl_PNGFilter::write(unsigned char const* data, size_t len)
 {
     size_t left = this->incoming - this->pos;
@@ -7,6 +7,11 @@
 #include <climits>
 #include <stdexcept>
+namespace
+{
+    unsigned long long memory_limit{0};
+} // namespace
+
 Pl_TIFFPredictor::Pl_TIFFPredictor(
     char const* identifier,
     Pipeline* next,
@@ -31,10 +36,19 @@ Pl_TIFFPredictor::Pl_TIFFPredictor(
     if ((bpr == 0) || (bpr > (UINT_MAX - 1))) {
         throw std::runtime_error("TIFFPredictor created with invalid columns value");
     }
+    if (memory_limit > 0 && bpr > (memory_limit / 2U)) {
+        throw std::runtime_error("TIFFPredictor memory limit exceeded");
+    }
     this->bytes_per_row = bpr & UINT_MAX;
 }
 void
+Pl_TIFFPredictor::setMemoryLimit(unsigned long long limit)
+{
+    memory_limit = limit;
+}
+
+void
 Pl_TIFFPredictor::write(unsigned char const* data, size_t len)
 {
     auto end = data + len;
@@ -332,7 +332,7 @@ QPDF::setSuppressWarnings(bool val)
 }
 void
-QPDF::setMaxWarnings(int val)
+QPDF::setMaxWarnings(size_t val)
 {
     m->max_warnings = val;
 }
@@ -504,13 +504,11 @@ QPDF::inParse(bool v)
 void
 QPDF::warn(QPDFExc const& e)
 {
+    if (m->max_warnings > 0 && m->warnings.size() >= m->max_warnings) {
+        stopOnError("Too many warnings - file is too badly damaged");
+    }
     m->warnings.push_back(e);
     if (!m->suppress_warnings) {
-        if (m->max_warnings > 0 && m->warnings.size() > 20) {
-            *m->log->getWarn() << "WARNING: too many warnings - additional warnings suppressed\n";
-            m->suppress_warnings = true;
-            return;
-        }
         *m->log->getWarn() << "WARNING: " << m->warnings.back().what() << "\n";
     }
 }
@@ -233,13 +233,12 @@ provide_data(std::shared_ptr&lt;InputSource&gt; is, qpdf_offset_t start, qpdf_offset_t
 class QPDF::JSONReactor: public JSON::Reactor
 {
   public:
-    JSONReactor(QPDF& pdf, std::shared_ptr<InputSource> is, bool must_be_complete, int max_warnings) :
+    JSONReactor(QPDF& pdf, std::shared_ptr<InputSource> is, bool must_be_complete) :
         pdf(pdf),
         is(is),
         must_be_complete(must_be_complete),
         descr(std::make_shared<QPDFValue::Description>(
-            QPDFValue::JSON_Descr(std::make_shared<std::string>(is->getName()), ""))),
-        max_warnings(max_warnings)
+            QPDFValue::JSON_Descr(std::make_shared<std::string>(is->getName()), "")))
     {
         for (auto& oc: pdf.m->obj_cache) {
             if (oc.second.object->getTypeCode() == ::ot_reserved) {
@@ -292,8 +291,7 @@ class QPDF::JSONReactor: public JSON::Reactor
     std::shared_ptr<InputSource> is;
     bool must_be_complete{true};
     std::shared_ptr<QPDFValue::Description> descr;
-    int errors{0};
-    int max_warnings{0};
+    bool errors{false};
     bool saw_qpdf{false};
     bool saw_qpdf_meta{false};
     bool saw_objects{false};
@@ -316,21 +314,18 @@ class QPDF::JSONReactor: public JSON::Reactor
 void
 QPDF::JSONReactor::error(qpdf_offset_t offset, std::string const& msg)
 {
-    ++errors;
+    errors = true;
     std::string object = this->cur_object;
     if (is->getName() != pdf.getFilename()) {
         object += " from " + is->getName();
     }
-    this->pdf.warn(qpdf_e_json, object, offset, msg);
-    if (max_warnings > 0 && errors >= max_warnings) {
-        throw std::runtime_error("errors found in JSON");
-    }
+    pdf.warn(qpdf_e_json, object, offset, msg);
 }
 bool
 QPDF::JSONReactor::anyErrors() const
 {
-    return errors > 0;
+    return errors;
 }
 void
@@ -825,7 +820,7 @@ QPDF::updateFromJSON(std::shared_ptr&lt;InputSource&gt; is)
 void
 QPDF::importJSON(std::shared_ptr<InputSource> is, bool must_be_complete)
 {
-    JSONReactor reactor(*this, is, must_be_complete, m->max_warnings);
+    JSONReactor reactor(*this, is, must_be_complete);
     try {
         JSON::parse(*is, &reactor);
     } catch (std::runtime_error& e) {
@@ -24,6 +24,10 @@ class Pl_PNGFilter: public Pipeline
         unsigned int bits_per_sample = 8);
     ~Pl_PNGFilter() override = default;
+    // Limit the memory used.
+    // NB This is a static option affecting all Pl_PNGFilter instances.
+    static void setMemoryLimit(unsigned long long limit);
+
     void write(unsigned char const* data, size_t len) override;
     void finish() override;
@@ -22,6 +22,10 @@ class Pl_TIFFPredictor: public Pipeline
         unsigned int bits_per_sample = 8);
     ~Pl_TIFFPredictor() override = default;
+    // Limit the memory used.
+    // NB This is a static option affecting all Pl_TIFFPredictor instances.
+    static void setMemoryLimit(unsigned long long limit);
+
     void write(unsigned char const* data, size_t len) override;
     void finish() override;