New issue
Advanced search Search tips

Issue 707431 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Apr 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Out-of-memory in pdf_codec_tiff_fuzzer

Project Member Reported by ClusterFuzz, Mar 31 2017

Issue description

Project Member

Comment 1 by ClusterFuzz, Apr 1 2017

Labels: OS-Mac
Cc: npm@chromium.org dsinclair@chromium.org
Components: Internals>Plugins>PDF
Labels: Test-Predator-Wrong M-59
Could someone please take a look?.
Thank you

Labels: -Pri-1 -M-59 Pri-2
Status: Available (was: Untriaged)
Cc: -npm@chromium.org
Owner: npm@chromium.org
Status: Assigned (was: Available)
npm@ can you take a look?
Project Member

Comment 5 by bugdroid1@chromium.org, Apr 5 2017

The following revision refers to this bug:
  https://pdfium.googlesource.com/pdfium/+/3198c681df875f7f268f03040b64343741d4bda1

commit 3198c681df875f7f268f03040b64343741d4bda1
Author: Nicolas Pena <npm@chromium.org>
Date: Wed Apr 05 20:29:31 2017

Libtiff: Prevent OOM in TIFFFillStrip

In TIFFFillStrip, calls to TIFFReadBufferSetup may allocate large amounts of
memory. In this CL we do sanity checks on the claimed size of the raw strip
data before that happens, to prevent out-of-memory.

Bug:  chromium:707431 
Change-Id: I4e7c9a8630fad11d4f68a3ceccd71ffa511f4293
Reviewed-on: https://pdfium-review.googlesource.com/3811
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

[add] https://crrev.com/3198c681df875f7f268f03040b64343741d4bda1/third_party/libtiff/0021-oom-TIFFFillStrip.patch
[modify] https://crrev.com/3198c681df875f7f268f03040b64343741d4bda1/third_party/libtiff/tif_read.c
[modify] https://crrev.com/3198c681df875f7f268f03040b64343741d4bda1/third_party/libtiff/README.pdfium

Project Member

Comment 6 by ClusterFuzz, Apr 6 2017

Project Member

Comment 7 by ClusterFuzz, Apr 6 2017

Labels: ClusterFuzz-Verified
Status: Verified (was: Assigned)
ClusterFuzz testcase 6691857099915264 is verified as fixed, so closing issue.

If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.

Sign in to add a comment