Coverage Report

Created: 2026-10-17 07:11

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/xpdf-4.06/build/fuzz_pdfload.cc
Line
Count
Source
1
/*  Copyright 2020 Google Inc.
2
3
Licensed under the Apache License, Version 2.0 (the "License");
4
you may not use this file except in compliance with the License.
5
You may obtain a copy of the License at
6
7
      http://www.apache.org/licenses/LICENSE-2.0
8
9
Unless required by applicable law or agreed to in writing, software
10
distributed under the License is distributed on an "AS IS" BASIS,
11
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
See the License for the specific language governing permissions and
13
limitations under the License.
14
*/
15
#include <fuzzer/FuzzedDataProvider.h>
16
17
#include <vector>
18
#include <aconf.h>
19
#include <stdio.h>
20
#include <stdint.h>
21
#include <stdlib.h>
22
#include <stddef.h>
23
#include <string.h>
24
#include <png.h>
25
26
#include "gmem.h"
27
#include "gmempp.h"
28
#include "parseargs.h"
29
#include "GString.h"
30
#include "gfile.h"
31
#include "GlobalParams.h"
32
#include "Object.h"
33
#include "PDFDoc.h"
34
#include "SplashBitmap.h"
35
#include "Splash.h"
36
#include "SplashOutputDev.h"
37
#include "Stream.h"
38
#include "config.h"
39
#include "JBIG2Stream.h"
40
41
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
42
9.46k
{
43
9.46k
    FuzzedDataProvider fdp (data, size);
44
9.46k
    double hdpi = fdp.ConsumeFloatingPoint<double>();
45
9.46k
    double vdpi = fdp.ConsumeFloatingPoint<double>();
46
9.46k
    int rotate = fdp.ConsumeIntegral<int>();
47
9.46k
    bool useMediaBox = fdp.ConsumeBool();
48
9.46k
    bool crop = fdp.ConsumeBool();
49
9.46k
    bool printing = fdp.ConsumeBool();
50
9.46k
    std::vector<char> payload = fdp.ConsumeRemainingBytes<char>();
51
52
9.46k
    Object xpdf_obj;
53
9.46k
    xpdf_obj.initNull();
54
9.46k
    BaseStream *stream = new MemStream(payload.data(), 0, payload.size(), &xpdf_obj);
55
56
9.46k
    Object info, xfa;
57
9.46k
    Object *acroForm;
58
9.46k
    globalParams = new GlobalParams(NULL);
59
9.46k
    globalParams->setErrQuiet(1);
60
9.46k
    globalParams->setupBaseFonts(NULL);
61
9.46k
    char yes[] = "yes";
62
9.46k
    globalParams->setEnableFreeType(yes);  // Yes, it's a string and not a bool.
63
9.46k
    globalParams->setErrQuiet(1);
64
65
9.46k
    PDFDoc *doc = NULL;
66
9.46k
    try {
67
9.46k
      PDFDoc doc(stream);
68
9.46k
        if (doc.isOk() == gTrue)
69
9.34k
        {
70
9.34k
            doc.getNumPages();
71
9.34k
            doc.getOutline();
72
9.34k
            doc.getStructTreeRoot();
73
9.34k
            doc.getXRef();
74
9.34k
            doc.okToPrint(gTrue);
75
9.34k
            doc.okToCopy(gTrue);
76
9.34k
            doc.okToChange(gTrue);
77
9.34k
            doc.okToAddNotes(gTrue);
78
9.34k
            doc.isLinearized();
79
9.34k
            doc.getPDFVersion();
80
81
9.34k
            GString *metadata;
82
9.34k
            if ((metadata = doc.readMetadata())) {
83
848
              (void)metadata->getCString();
84
848
            }
85
9.34k
            delete metadata;
86
87
9.34k
            Object info;
88
9.34k
            doc.getDocInfo(&info);
89
9.34k
            if (info.isDict()) {
90
2.50k
              info.getDict();
91
2.50k
            }
92
9.34k
            info.free();
93
94
9.34k
            if ((acroForm = doc.getCatalog()->getAcroForm())->isDict()) {
95
758
                acroForm->dictLookup("XFA", &xfa);
96
758
                xfa.free();
97
758
            }
98
99
47.2k
            for (size_t i = 1; i <= doc.getNumPages(); i++) {
100
37.8k
              doc.getLinks(i);
101
37.8k
              auto page = doc.getCatalog()->getPage(i);
102
37.8k
              if (!page->isOk()) {
103
0
                continue;
104
0
              }
105
37.8k
              page->getResourceDict();
106
37.8k
              page->getMetadata();
107
37.8k
              page->getResourceDict();
108
37.8k
            }
109
110
9.34k
            SplashColor paperColor = {0xff, 0xff, 0xff};
111
9.34k
            SplashOutputDev *splashOut = new SplashOutputDev(splashModeRGB8, 1, gFalse, paperColor);
112
9.34k
            splashOut->setNoComposite(gTrue);
113
9.34k
            splashOut->startDoc(doc.getXRef());
114
47.2k
            for (size_t i = 1; i <= doc.getNumPages(); ++i) {
115
37.8k
              doc.displayPage(splashOut, NULL, i, hdpi, vdpi, rotate, useMediaBox, crop, printing);
116
37.8k
            }
117
9.34k
            (void)splashOut->getBitmap();
118
119
9.34k
            delete splashOut;
120
9.34k
        }
121
9.46k
    } catch (...) {
122
123
21
    }
124
125
9.46k
    delete globalParams;
126
127
9.46k
    return 0;
128
9.46k
}
129