New issue
Advanced search Search tips

Issue 636559 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

Create fuzzer for PDFium's hint table/stream reader

Project Member Reported by thestig@chromium.org, Aug 10 2016

Issue description

 Bug 635565  is an example where PDFium crashes due to bad hint table data. Since the hint table is just hint data, it is not required to load PDFs. 

Would a fuzzer be a good tool to help us flush out all the cases where the code is too strict with safe_math checks? Instead, the crashes should be handled and turned into failures that return false/nullptr.
 

Comment 1 by och...@chromium.org, Aug 10 2016

Seems like libFuzzer (https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/README.md) might work well for this if there's an entry point function to exercise this part of the code that can be built as a standalone binary.
Owner: thestig@chromium.org
Status: Assigned (was: Available)
I'll take it.
Project Member

Comment 3 by bugdroid1@chromium.org, Aug 19 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b9dc835015e914ded4f4f3db0bd9e95aaf7d7c03

commit b9dc835015e914ded4f4f3db0bd9e95aaf7d7c03
Author: pdfium-deps-roller <pdfium-deps-roller@chromium.org>
Date: Fri Aug 19 23:30:52 2016

Roll src/third_party/pdfium/ bb5fa043a..5b13e1dc5 (1 commit).

https://pdfium.googlesource.com/pdfium.git/+log/bb5fa043a7ef..5b13e1dc5770

$ git log bb5fa043a..5b13e1dc5 --date=short --no-merges --format='%ad %ae %s'
2016-08-19 thestig Add a fuzzer for CPDF_HintTables.

BUG= 636559 

TBR=dsinclair@chromium.org

Review-Url: https://codereview.chromium.org/2264733002
Cr-Commit-Position: refs/heads/master@{#413284}

[modify] https://crrev.com/b9dc835015e914ded4f4f3db0bd9e95aaf7d7c03/DEPS

Project Member

Comment 4 by bugdroid1@chromium.org, Aug 20 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e8ad85572cd463bfb07d89140267e47e507f1caa

commit e8ad85572cd463bfb07d89140267e47e507f1caa
Author: thestig <thestig@chromium.org>
Date: Sat Aug 20 04:25:09 2016

Build rule for pdf_hint_table_fuzzer

Add the Chromium side build rules for the hint table fuzzer.

BUG= 636559 

Review-Url: https://codereview.chromium.org/2262623002
Cr-Commit-Position: refs/heads/master@{#413320}

[modify] https://crrev.com/e8ad85572cd463bfb07d89140267e47e507f1caa/pdf/pdfium/fuzzers/BUILD.gn

Status: Fixed (was: Assigned)

Sign in to add a comment