/src/qpdf/fuzz/dct_fuzzer.cc
Line | Count | Source |
1 | | #include <qpdf/Pl_DCT.hh> |
2 | | #include <qpdf/Pl_Discard.hh> |
3 | | #include <cstdlib> |
4 | | #include <iostream> |
5 | | #include <stdexcept> |
6 | | |
7 | | class FuzzHelper |
8 | | { |
9 | | public: |
10 | | FuzzHelper(unsigned char const* data, size_t size); |
11 | | void run(); |
12 | | |
13 | | private: |
14 | | void doChecks(); |
15 | | |
16 | | unsigned char const* data; |
17 | | size_t size; |
18 | | }; |
19 | | |
20 | | FuzzHelper::FuzzHelper(unsigned char const* data, size_t size) : |
21 | 6.77k | data(data), |
22 | 6.77k | size(size) |
23 | 6.77k | { |
24 | 6.77k | } |
25 | | |
26 | | void |
27 | | FuzzHelper::doChecks() |
28 | 6.77k | { |
29 | | // Limit the memory used to decompress JPEG files during fuzzing. Excessive memory use during |
30 | | // fuzzing is due to corrupt JPEG data which sometimes cannot be detected before |
31 | | // jpeg_start_decompress is called. During normal use of qpdf very large JPEGs can occasionally |
32 | | // occur legitimately and therefore must be allowed during normal operations. |
33 | 6.77k | Pl_DCT::setMemoryLimit(200'000'000); |
34 | 6.77k | Pl_DCT::setScanLimit(50); |
35 | | |
36 | | // Do not decompress corrupt data. This may cause extended runtime within jpeglib without |
37 | | // exercising additional code paths in qpdf. |
38 | 6.77k | Pl_DCT::setThrowOnCorruptData(true); |
39 | | |
40 | 6.77k | Pl_Discard discard; |
41 | 6.77k | Pl_DCT p("decode", &discard); |
42 | 6.77k | p.write(const_cast<unsigned char*>(data), size); |
43 | 6.77k | p.finish(); |
44 | 6.77k | } |
45 | | |
46 | | void |
47 | | FuzzHelper::run() |
48 | 6.77k | { |
49 | 6.77k | try { |
50 | 6.77k | doChecks(); |
51 | 6.77k | } catch (std::runtime_error const& e) { |
52 | 6.07k | std::cerr << "runtime_error: " << e.what() << '\n'; |
53 | 6.07k | } |
54 | 6.77k | } |
55 | | |
56 | | extern "C" int |
57 | | LLVMFuzzerTestOneInput(unsigned char const* data, size_t size) |
58 | 6.77k | { |
59 | 6.77k | #ifndef _WIN32 |
60 | | // Used by jpeg library to work around false positives in memory |
61 | | // sanitizer. |
62 | 6.77k | setenv("JSIMD_FORCENONE", "1", 1); |
63 | 6.77k | #endif |
64 | 6.77k | FuzzHelper f(data, size); |
65 | 6.77k | f.run(); |
66 | 6.77k | return 0; |
67 | 6.77k | } |