Coverage Report

Created: 2026-07-04 07:11

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/xpdf-4.06/build/fuzz_pdfload.cc
Line
Count
Source
1
/*  Copyright 2020 Google Inc.
2
3
Licensed under the Apache License, Version 2.0 (the "License");
4
you may not use this file except in compliance with the License.
5
You may obtain a copy of the License at
6
7
      http://www.apache.org/licenses/LICENSE-2.0
8
9
Unless required by applicable law or agreed to in writing, software
10
distributed under the License is distributed on an "AS IS" BASIS,
11
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
See the License for the specific language governing permissions and
13
limitations under the License.
14
*/
15
#include <fuzzer/FuzzedDataProvider.h>
16
17
#include <vector>
18
#include <aconf.h>
19
#include <stdio.h>
20
#include <stdint.h>
21
#include <stdlib.h>
22
#include <stddef.h>
23
#include <string.h>
24
#include <png.h>
25
26
#include "gmem.h"
27
#include "gmempp.h"
28
#include "parseargs.h"
29
#include "GString.h"
30
#include "gfile.h"
31
#include "GlobalParams.h"
32
#include "Object.h"
33
#include "PDFDoc.h"
34
#include "SplashBitmap.h"
35
#include "Splash.h"
36
#include "SplashOutputDev.h"
37
#include "Stream.h"
38
#include "config.h"
39
#include "JBIG2Stream.h"
40
41
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
42
16.5k
{
43
16.5k
    FuzzedDataProvider fdp (data, size);
44
16.5k
    double hdpi = fdp.ConsumeFloatingPoint<double>();
45
16.5k
    double vdpi = fdp.ConsumeFloatingPoint<double>();
46
16.5k
    int rotate = fdp.ConsumeIntegral<int>();
47
16.5k
    bool useMediaBox = fdp.ConsumeBool();
48
16.5k
    bool crop = fdp.ConsumeBool();
49
16.5k
    bool printing = fdp.ConsumeBool();
50
16.5k
    std::vector<char> payload = fdp.ConsumeRemainingBytes<char>();
51
52
16.5k
    Object xpdf_obj;
53
16.5k
    xpdf_obj.initNull();
54
16.5k
    BaseStream *stream = new MemStream(payload.data(), 0, payload.size(), &xpdf_obj);
55
56
16.5k
    Object info, xfa;
57
16.5k
    Object *acroForm;
58
16.5k
    globalParams = new GlobalParams(NULL);
59
16.5k
    globalParams->setErrQuiet(1);
60
16.5k
    globalParams->setupBaseFonts(NULL);
61
16.5k
    char yes[] = "yes";
62
16.5k
    globalParams->setEnableFreeType(yes);  // Yes, it's a string and not a bool.
63
16.5k
    globalParams->setErrQuiet(1);
64
65
16.5k
    PDFDoc *doc = NULL;
66
16.5k
    try {
67
16.5k
      PDFDoc doc(stream);
68
16.5k
        if (doc.isOk() == gTrue)
69
15.5k
        {
70
15.5k
            doc.getNumPages();
71
15.5k
            doc.getOutline();
72
15.5k
            doc.getStructTreeRoot();
73
15.5k
            doc.getXRef();
74
15.5k
            doc.okToPrint(gTrue);
75
15.5k
            doc.okToCopy(gTrue);
76
15.5k
            doc.okToChange(gTrue);
77
15.5k
            doc.okToAddNotes(gTrue);
78
15.5k
            doc.isLinearized();
79
15.5k
            doc.getPDFVersion();
80
81
15.5k
            GString *metadata;
82
15.5k
            if ((metadata = doc.readMetadata())) {
83
1.12k
              (void)metadata->getCString();
84
1.12k
            }
85
15.5k
            delete metadata;
86
87
15.5k
            Object info;
88
15.5k
            doc.getDocInfo(&info);
89
15.5k
            if (info.isDict()) {
90
3.21k
              info.getDict();
91
3.21k
            }
92
15.5k
            info.free();
93
94
15.5k
            if ((acroForm = doc.getCatalog()->getAcroForm())->isDict()) {
95
1.35k
                acroForm->dictLookup("XFA", &xfa);
96
1.35k
                xfa.free();
97
1.35k
            }
98
99
185k
            for (size_t i = 1; i <= doc.getNumPages(); i++) {
100
169k
              doc.getLinks(i);
101
169k
              auto page = doc.getCatalog()->getPage(i);
102
169k
              if (!page->isOk()) {
103
0
                continue;
104
0
              }
105
169k
              page->getResourceDict();
106
169k
              page->getMetadata();
107
169k
              page->getResourceDict();
108
169k
            }
109
110
15.5k
            SplashColor paperColor = {0xff, 0xff, 0xff};
111
15.5k
            SplashOutputDev *splashOut = new SplashOutputDev(splashModeRGB8, 1, gFalse, paperColor);
112
15.5k
            splashOut->setNoComposite(gTrue);
113
15.5k
            splashOut->startDoc(doc.getXRef());
114
185k
            for (size_t i = 1; i <= doc.getNumPages(); ++i) {
115
169k
              doc.displayPage(splashOut, NULL, i, hdpi, vdpi, rotate, useMediaBox, crop, printing);
116
169k
            }
117
15.5k
            (void)splashOut->getBitmap();
118
119
15.5k
            delete splashOut;
120
15.5k
        }
121
16.5k
    } catch (...) {
122
123
42
    }
124
125
16.5k
    delete globalParams;
126
127
16.5k
    return 0;
128
16.5k
}
129