Further limit size of uncompressed JPEG for fuzzing

Try a limit of 50MB. For very large limits processing time before damage is encountered may exceed oss-fuzz limits. Add further test cases.

Further limit size of uncompressed JPEG for fuzzing
Try a limit of 50MB. For very large limits processing time before damage is encountered may exceed oss-fuzz limits. Add further test cases.
m-holger
1 parent e914bbbb
Showing 5 changed files with 7 additions and 6 deletions
fuzz/dct_fuzzer_seed_corpus/25297ce5437bb882fbbd5073334d2eb64fb9c40b
fuzz/dct_fuzzer_seed_corpus/f48621948bc5b8c7debabe2fbec04cad56927e12
fuzz/qtest/fuzz.test
libqpdf/Pl_DCT.cc
libqpdf/QPDF_pages.cc
@@ -13,7 +13,7 @@ my $qpdf_corpus = $ENV{&#39;QPDF_FUZZ_CORPUS&#39;} || die &quot;must set QPDF_FUZZ_CORPUS&quot;;
 my @fuzzers = (
     ['ascii85' => 1],
-    ['dct' => 2],
+    ['dct' => 4],
     ['flate' => 1],
     ['hex' => 1],
     ['json' => 40],
@@ -335,10 +335,11 @@ Pl_DCT::decompress(void* cinfo_p, Buffer* b)
     (void)jpeg_calc_output_dimensions(cinfo);
     unsigned int width = cinfo->output_width * QIntC::to_uint(cinfo->output_components);
     if (memory_limit > 0 &&
-        width > (static_cast<unsigned long>(memory_limit) / (2U * cinfo->output_height))) {
-        // Even if jpeglib does not run out of memory, qpdf will while buffering thye data before
-        // writing it.
-        throw std::runtime_error("Pl_DCT::decompress: JPEG data exceeds memory limit");
+        width > (static_cast<unsigned long>(memory_limit) / (20U * cinfo->output_height))) {
+        // Even if jpeglib does not run out of memory, qpdf will while buffering the data before
+        // writing it. Furthermore, for very large images runtime can be significant before the
+        // first warning is encountered causing a timeout in oss-fuzz.
+        throw std::runtime_error("Pl_DCT::decompress: JPEG data large - may be too slow");
     }
     JSAMPARRAY buffer =
         (*cinfo->mem->alloc_sarray)(reinterpret_cast<j_common_ptr>(cinfo), JPOOL_IMAGE, width, 1);
@@ -99,7 +99,7 @@ QPDF::getAllPagesInternal(
     for (int i = 0; i < n; ++i) {
         auto kid = kids.getArrayItem(i);
         if (!kid.isDictionary()) {
-            kid.warnIfPossible("Pages tree includes non-dictionary object; removing");
+            kid.warnIfPossible("Pages tree includes non-dictionary object; ignoring");
             continue;
         }
         if (kid.hasKey("/Kids")) {