Coverage Report

Created: 2026-01-10 06:59

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/qpdf/fuzz/dct_fuzzer.cc
Line
Count
Source
1
#include <qpdf/Pl_DCT.hh>
2
#include <qpdf/Pl_Discard.hh>
3
#include <cstdlib>
4
#include <iostream>
5
#include <stdexcept>
6
7
class FuzzHelper
8
{
9
  public:
10
    FuzzHelper(unsigned char const* data, size_t size);
11
    void run();
12
13
  private:
14
    void doChecks();
15
16
    unsigned char const* data;
17
    size_t size;
18
};
19
20
FuzzHelper::FuzzHelper(unsigned char const* data, size_t size) :
21
6.77k
    data(data),
22
6.77k
    size(size)
23
6.77k
{
24
6.77k
}
25
26
void
27
FuzzHelper::doChecks()
28
6.77k
{
29
    // Limit the memory used to decompress JPEG files during fuzzing. Excessive memory use during
30
    // fuzzing is due to corrupt JPEG data which sometimes cannot be detected before
31
    // jpeg_start_decompress is called. During normal use of qpdf very large JPEGs can occasionally
32
    // occur legitimately and therefore must be allowed during normal operations.
33
6.77k
    Pl_DCT::setMemoryLimit(200'000'000);
34
6.77k
    Pl_DCT::setScanLimit(50);
35
36
    // Do not decompress corrupt data. This may cause extended runtime within jpeglib without
37
    // exercising additional code paths in qpdf.
38
6.77k
    Pl_DCT::setThrowOnCorruptData(true);
39
40
6.77k
    Pl_Discard discard;
41
6.77k
    Pl_DCT p("decode", &discard);
42
6.77k
    p.write(const_cast<unsigned char*>(data), size);
43
6.77k
    p.finish();
44
6.77k
}
45
46
void
47
FuzzHelper::run()
48
6.77k
{
49
6.77k
    try {
50
6.77k
        doChecks();
51
6.77k
    } catch (std::runtime_error const& e) {
52
6.07k
        std::cerr << "runtime_error: " << e.what() << '\n';
53
6.07k
    }
54
6.77k
}
55
56
extern "C" int
57
LLVMFuzzerTestOneInput(unsigned char const* data, size_t size)
58
6.77k
{
59
6.77k
#ifndef _WIN32
60
    // Used by jpeg library to work around false positives in memory
61
    // sanitizer.
62
6.77k
    setenv("JSIMD_FORCENONE", "1", 1);
63
6.77k
#endif
64
6.77k
    FuzzHelper f(data, size);
65
6.77k
    f.run();
66
6.77k
    return 0;
67
6.77k
}