OpenSystemsDevelopment / qpdf

Commit dcf111a9bcc0dc7dcc96eb7884b48355c2d5eb1e

Authored by m-holger
1 parent bcf56e53

Apply fuzzer Pl_Flate memory limit only when inflating 

Fixes fuzz issue 71689.
Inline Side-by-side
Showing 5 changed files with 4 additions and 10 deletions
fuzz/CMakeLists.txt
  View file @dcf111a
... ... @@ -141,6 +141,7 @@ set(CORPUS_OTHER
141 141 70306a.fuzz
142 142 70306b.fuzz
143 143 71624.fuzz
  144 + 71689.fuzz
144 145 )
145 146  
146 147 set(CORPUS_DIR ${CMAKE_CURRENT_BINARY_DIR}/qpdf_corpus)
... ...
fuzz/qpdf_extra/71689.fuzz 0 → 100644
View file @dcf111a
No preview for this file type
fuzz/qpdf_fuzzer.cc
  View file @dcf111a
... ... @@ -93,13 +93,6 @@ FuzzHelper::testWrite()
93 93 w->setDeterministicID(true);
94 94 w->setQDFMode(true);
95 95 doWrite(w);
96   -
97   - q = getQpdf();
98   - w = getWriter(q);
99   - w->setStaticID(true);
100   - w->setLinearization(true);
101   - w->setR6EncryptionParameters("u", "o", true, true, true, true, true, true, qpdf_r3p_full, true);
102   - doWrite(w);
103 96 }
104 97  
105 98 void
... ...
fuzz/qtest/fuzz.test
  View file @dcf111a
... ... @@ -11,7 +11,7 @@ my $td = new TestDriver('fuzz');
11 11  
12 12 my $qpdf_corpus = $ENV{'QPDF_FUZZ_CORPUS'} || die "must set QPDF_FUZZ_CORPUS";
13 13  
14   -my $n_qpdf_files = 78; # increment when adding new files
  14 +my $n_qpdf_files = 79; # increment when adding new files
15 15  
16 16 my @fuzzers = (
17 17 ['ascii85' => 1],
... ...
libqpdf/Pl_Flate.cc
  View file @dcf111a
... ... @@ -181,7 +181,7 @@ Pl_Flate::handleData(unsigned char const* data, size_t len, int flush)
181 181 }
182 182 uLong ready = QIntC::to_ulong(m->out_bufsize - zstream.avail_out);
183 183 if (ready > 0) {
184   - if (memory_limit) {
  184 + if (memory_limit && m->action != a_deflate) {
185 185 m->written += ready;
186 186 if (m->written > memory_limit) {
187 187 throw std::runtime_error("PL_Flate memory limit exceeded");
... ... @@ -205,7 +205,7 @@ void
205 205 Pl_Flate::finish()
206 206 {
207 207 if (m->written > memory_limit) {
208   - return;
  208 + throw std::runtime_error("PL_Flate memory limit exceeded");
209 209 }
210 210 try {
211 211 if (m->outbuf.get()) {
... ...