Detect stream in object stream, fixing fuzz 16214

It's detected in QPDFWriter instead of at parse time because I can't
figure out how to construct a test case in a reasonable time. This
commit moves the fuzz file into the regular test suite for a QTC
coverage case.

4 files changed, 27 insertions, 2 deletions

diff --git a/qpdf/qpdf.testcov b/qpdf/qpdf.testcov
index c8ad0bdd..f327d464 100644
--- a/qpdf/qpdf.testcov
+++ b/qpdf/qpdf.testcov
@@ -444,3 +444,4 @@ QPDF xref skipped space 0
 QPDF eof skipping spaces before xref 1
 QPDF_encryption user matches owner V < 5 0
 QPDF_encryption same password 1
+QPDFWriter stream in ostream 0
diff --git a/qpdf/qtest/qpdf.test b/qpdf/qtest/qpdf.test
index 00f29c72..41c94519 100644
--- a/qpdf/qtest/qpdf.test
+++ b/qpdf/qtest/qpdf.test
@@ -643,6 +643,7 @@ my @bug_tests = (
     ["263", "empty xref stream", 2],
     ["335a", "ozz-fuzz-12152", 2],
     ["335b", "ozz-fuzz-14845", 2],
+    ["fuzz-16214", "stream in object stream", 3],
     # When adding to this list, consider adding to SEED_CORPUS_FILES
     # in fuzz/build.mk and updating the count in fuzz/qtest/fuzz.test.
     );
@@ -669,9 +670,10 @@ foreach my $d (@bug_tests)
     }
     else
     {
+        my $base = (-f "issue-$n.pdf") ? "issue-$n" : "$n";
         $td->runtest($description,
-                     {$td->COMMAND => "qpdf issue-$n.pdf a.pdf"},
-                     {$td->FILE => "issue-$n.out",
+                     {$td->COMMAND => "qpdf $base.pdf a.pdf"},
+                     {$td->FILE => "$base.out",
                           $td->EXIT_STATUS => $exit_status},
                      $td->NORMALIZE_NEWLINES);
     }
diff --git a/qpdf/qtest/qpdf/fuzz-16214.out b/qpdf/qtest/qpdf/fuzz-16214.out
new file mode 100644
index 00000000..55862b1a
--- /dev/null
+++ b/qpdf/qtest/qpdf/fuzz-16214.out
@@ -0,0 +1,22 @@
+WARNING: fuzz-16214.pdf: can't find PDF header
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 124): stream dictionary lacks /Length key
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 353): attempting to recover stream length
+WARNING: fuzz-16214.pdf (xref stream: object 5 0, offset 353): recovered stream length: 722
+WARNING: fuzz-16214.pdf (xref stream, offset 116): Cross-reference stream data has the wrong size; expected = 92; actual = 196
+WARNING: fuzz-16214.pdf: reported number of objects (6) is not one plus the highest object number (35)
+WARNING: fuzz-16214.pdf (object 14 0, offset 652): expected dictionary key but found non-name object; inserting key /QPDFFake1
+WARNING: fuzz-16214.pdf (object 14 0, offset 734): expected endobj
+WARNING: fuzz-16214.pdf: file is damaged
+WARNING: fuzz-16214.pdf (object 1 0, offset 7189): expected n n obj
+WARNING: fuzz-16214.pdf: Attempting to reconstruct cross-reference table
+WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
+WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
+WARNING: fuzz-16214.pdf (offset 7207): error decoding stream data for object 2 0: stream inflate: inflate: data: invalid code lengths set
+WARNING: fuzz-16214.pdf (offset 7207): getStreamData called on unfilterable stream
+WARNING: fuzz-16214.pdf (object 11 0, offset 11551): supposed object stream 5 has wrong type
+WARNING: fuzz-16214.pdf (object 21 0, offset 3639): expected endstream
+WARNING: fuzz-16214.pdf (object 21 0, offset 3112): attempting to recover stream length
+WARNING: fuzz-16214.pdf (object 21 0, offset 3112): recovered stream length: 340
+WARNING: fuzz-16214.pdf, stream object 8 0: stream found inside object stream; treating as null
+WARNING: fuzz-16214.pdf, stream object 8 0: stream found inside object stream; treating as null
+qpdf: operation succeeded with warnings; resulting file may have some problems
diff --git a/qpdf/qtest/qpdf/fuzz-16214.pdf b/qpdf/qtest/qpdf/fuzz-16214.pdf
new file mode 100644
index 00000000..c84a8eba
--- /dev/null
+++ b/qpdf/qtest/qpdf/fuzz-16214.pdf