/src/qpdf/fuzz/qpdf_crypt_insecure_fuzzer.cc
Line | Count | Source |
1 | | #include <qpdf/Buffer.hh> |
2 | | #include <qpdf/BufferInputSource.hh> |
3 | | #include <qpdf/Pl_Discard.hh> |
4 | | #include <qpdf/Pl_Flate.hh> |
5 | | #include <qpdf/QPDF.hh> |
6 | | #include <qpdf/QPDFWriter.hh> |
7 | | #include <qpdf/QUtil.hh> |
8 | | #include <qpdf/global.hh> |
9 | | |
10 | | class FuzzHelper |
11 | | { |
12 | | public: |
13 | | FuzzHelper(unsigned char const* data, size_t size) : |
14 | | // We do not modify data, so it is safe to remove the const for Buffer |
15 | 271k | input_buffer(const_cast<unsigned char*>(data), size) |
16 | 271k | { |
17 | 271k | } |
18 | | |
19 | | void |
20 | | run() |
21 | 179k | { |
22 | 179k | qpdf::global::options::fuzz_mode(true); |
23 | | // The goal here is that you should be able to throw anything at libqpdf and it will respond |
24 | | // without any memory errors and never do anything worse than throwing a QPDFExc or |
25 | | // std::runtime_error. Throwing any other kind of exception, segfaulting, or having a memory |
26 | | // error (when built with appropriate sanitizers) will all cause abnormal exit. |
27 | 179k | try { |
28 | 179k | std::cerr << "\ninfo: starting testWrite\n"; |
29 | | // Write in various ways to exercise QPDFWriter |
30 | | |
31 | 179k | auto is = std::make_shared<BufferInputSource>("fuzz input", &input_buffer); |
32 | 179k | QPDF qpdf; |
33 | 179k | qpdf.processInputSource(is); |
34 | 179k | QPDFWriter w(qpdf); |
35 | 179k | w.setOutputPipeline(&discard); |
36 | 179k | w.setDecodeLevel(qpdf_dl_all); |
37 | 179k | w.setStaticID(true); |
38 | 179k | w.setObjectStreamMode(qpdf_o_disable); |
39 | 179k | w.setR3EncryptionParametersInsecure( |
40 | 179k | "u", "o", true, true, true, true, true, true, qpdf_r3p_full); |
41 | 179k | w.write(); |
42 | 179k | } catch (std::runtime_error const& e) { |
43 | 117k | std::cerr << "runtime_error: " << e.what() << '\n'; |
44 | 117k | } |
45 | 179k | } |
46 | | |
47 | | private: |
48 | | Buffer input_buffer; |
49 | | Pl_Discard discard; |
50 | | }; |
51 | | |
52 | | extern "C" int |
53 | | LLVMFuzzerTestOneInput(unsigned char const* data, size_t size) |
54 | 271k | { |
55 | 271k | #ifndef _WIN32 |
56 | | // Used by jpeg library to work around false positives in memory sanitizer. |
57 | 271k | setenv("JSIMD_FORCENONE", "1", 1); |
58 | 271k | #endif |
59 | 271k | FuzzHelper f(data, size); |
60 | 271k | f.run(); |
61 | 271k | return 0; |
62 | 271k | } |