Coverage Report

Created: 2026-10-13 06:47

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/xpdf-4.06/build/fuzz_pdfload.cc
Line
Count
Source
1
/*  Copyright 2020 Google Inc.
2
3
Licensed under the Apache License, Version 2.0 (the "License");
4
you may not use this file except in compliance with the License.
5
You may obtain a copy of the License at
6
7
      http://www.apache.org/licenses/LICENSE-2.0
8
9
Unless required by applicable law or agreed to in writing, software
10
distributed under the License is distributed on an "AS IS" BASIS,
11
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
See the License for the specific language governing permissions and
13
limitations under the License.
14
*/
15
#include <fuzzer/FuzzedDataProvider.h>
16
17
#include <vector>
18
#include <aconf.h>
19
#include <stdio.h>
20
#include <stdint.h>
21
#include <stdlib.h>
22
#include <stddef.h>
23
#include <string.h>
24
#include <png.h>
25
26
#include "gmem.h"
27
#include "gmempp.h"
28
#include "parseargs.h"
29
#include "GString.h"
30
#include "gfile.h"
31
#include "GlobalParams.h"
32
#include "Object.h"
33
#include "PDFDoc.h"
34
#include "SplashBitmap.h"
35
#include "Splash.h"
36
#include "SplashOutputDev.h"
37
#include "Stream.h"
38
#include "config.h"
39
#include "JBIG2Stream.h"
40
41
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
42
9.29k
{
43
9.29k
    FuzzedDataProvider fdp (data, size);
44
9.29k
    double hdpi = fdp.ConsumeFloatingPoint<double>();
45
9.29k
    double vdpi = fdp.ConsumeFloatingPoint<double>();
46
9.29k
    int rotate = fdp.ConsumeIntegral<int>();
47
9.29k
    bool useMediaBox = fdp.ConsumeBool();
48
9.29k
    bool crop = fdp.ConsumeBool();
49
9.29k
    bool printing = fdp.ConsumeBool();
50
9.29k
    std::vector<char> payload = fdp.ConsumeRemainingBytes<char>();
51
52
9.29k
    Object xpdf_obj;
53
9.29k
    xpdf_obj.initNull();
54
9.29k
    BaseStream *stream = new MemStream(payload.data(), 0, payload.size(), &xpdf_obj);
55
56
9.29k
    Object info, xfa;
57
9.29k
    Object *acroForm;
58
9.29k
    globalParams = new GlobalParams(NULL);
59
9.29k
    globalParams->setErrQuiet(1);
60
9.29k
    globalParams->setupBaseFonts(NULL);
61
9.29k
    char yes[] = "yes";
62
9.29k
    globalParams->setEnableFreeType(yes);  // Yes, it's a string and not a bool.
63
9.29k
    globalParams->setErrQuiet(1);
64
65
9.29k
    PDFDoc *doc = NULL;
66
9.29k
    try {
67
9.29k
      PDFDoc doc(stream);
68
9.29k
        if (doc.isOk() == gTrue)
69
9.16k
        {
70
9.16k
            doc.getNumPages();
71
9.16k
            doc.getOutline();
72
9.16k
            doc.getStructTreeRoot();
73
9.16k
            doc.getXRef();
74
9.16k
            doc.okToPrint(gTrue);
75
9.16k
            doc.okToCopy(gTrue);
76
9.16k
            doc.okToChange(gTrue);
77
9.16k
            doc.okToAddNotes(gTrue);
78
9.16k
            doc.isLinearized();
79
9.16k
            doc.getPDFVersion();
80
81
9.16k
            GString *metadata;
82
9.16k
            if ((metadata = doc.readMetadata())) {
83
827
              (void)metadata->getCString();
84
827
            }
85
9.16k
            delete metadata;
86
87
9.16k
            Object info;
88
9.16k
            doc.getDocInfo(&info);
89
9.16k
            if (info.isDict()) {
90
2.48k
              info.getDict();
91
2.48k
            }
92
9.16k
            info.free();
93
94
9.16k
            if ((acroForm = doc.getCatalog()->getAcroForm())->isDict()) {
95
737
                acroForm->dictLookup("XFA", &xfa);
96
737
                xfa.free();
97
737
            }
98
99
46.3k
            for (size_t i = 1; i <= doc.getNumPages(); i++) {
100
37.1k
              doc.getLinks(i);
101
37.1k
              auto page = doc.getCatalog()->getPage(i);
102
37.1k
              if (!page->isOk()) {
103
0
                continue;
104
0
              }
105
37.1k
              page->getResourceDict();
106
37.1k
              page->getMetadata();
107
37.1k
              page->getResourceDict();
108
37.1k
            }
109
110
9.16k
            SplashColor paperColor = {0xff, 0xff, 0xff};
111
9.16k
            SplashOutputDev *splashOut = new SplashOutputDev(splashModeRGB8, 1, gFalse, paperColor);
112
9.16k
            splashOut->setNoComposite(gTrue);
113
9.16k
            splashOut->startDoc(doc.getXRef());
114
46.3k
            for (size_t i = 1; i <= doc.getNumPages(); ++i) {
115
37.1k
              doc.displayPage(splashOut, NULL, i, hdpi, vdpi, rotate, useMediaBox, crop, printing);
116
37.1k
            }
117
9.16k
            (void)splashOut->getBitmap();
118
119
9.16k
            delete splashOut;
120
9.16k
        }
121
9.29k
    } catch (...) {
122
123
20
    }
124
125
9.29k
    delete globalParams;
126
127
9.29k
    return 0;
128
9.29k
}
129