aboutsummaryrefslogtreecommitdiffstats
path: root/fuzz
AgeCommit message (Collapse)Author
2024-02-06Detect end of input inside an unfinished JSON stringJay Berkenbilt
2024-02-06Detect JSON object whose value is an indirect objectJay Berkenbilt
2024-02-04Fix JSON parser error found by fuzzJay Berkenbilt
2024-02-04Add json fuzzer with seed files from #1123 and test suiteJay Berkenbilt
...as well as some cases generated in CI from earlier attempts at fixing this.
2024-02-03Exercise more parameters of the tiff predictor in fuzzJay Berkenbilt
2024-02-03Add additional test case for fuzz testsm-holger
2024-01-17Fix incorrect handling of invalid negative object idsm-holger
Fix two errors introduced in #1110 and #1112. Since #1110, encountering the invalid indirect reference #1110 -2147483648 n R produces an integer underflow which, if undetected, immediately trigger a logic error. Since #1112, object -1 0 R may be incorrectly identified as an earlier generation of itself and deleted, invalidating a live iterator.
2024-01-12Fix null pointer issue on array copyJay Berkenbilt
2023-05-21Rerun clang-formatJay Berkenbilt
2023-05-20Replace 'virtual' specifier with 'override'm-holger
2023-05-05Add the file to reproduce fuzz issue 57639Jay Berkenbilt
It is possible to reproduce the failure with this file following the instructions with oss-fuzz, though it does not cause a failure in CI. The failure was introduced in 18c1ffe0df335a46cddbeb96e2cb939d850df9fa.
2022-09-02Disable copying/assigning to QPDF objects, add QPDF::create()Jay Berkenbilt
2022-05-21Code clean up: use range-style for loops wherever possiblem-holger
Remove variables obsoleted by commit 4f24617.
2022-05-07Prepare code for JSON v2Jay Berkenbilt
Update getJSON() methods and calls to them
2022-04-30Mark weak encryption with API changes (fixes #576)Jay Berkenbilt
2022-04-30Code clean up: use range-style for loops wherever possibleJay Berkenbilt
Where not possible, use "auto" to get the iterator type. Editorial note: I have avoid this change for a long time because of not wanting to make gratuitous changes to version history, which can obscure when certain changes were made, but with having recently touched every single file to apply automatic code formatting and with making several broad changes to the API, I decided it was time to take the plunge and get rid of the older (pre-C++11) verbose iterator syntax. The new code is just easier to read and understand, and in many cases, it will be more effecient as fewer temporary copies are being made. m-holger, if you're reading, you can see that I've finally come around. :-)
2022-04-16Use = default and = delete where possible in classesJay Berkenbilt
2022-04-09Replace PointerHolder with std::shared_ptr in the rest of the codeJay Berkenbilt
Increase to POINTERHOLDER_TRANSITION=3 patrepl s/PointerHolder/std::shared_ptr/g **/*.cc **/*.hh patrepl s/make_pointer_holder/std::make_shared/g **/*.cc patrepl s/make_array_pointer_holder/QUtil::make_shared_array/g **/*.cc patrepl s,qpdf/std::shared_ptr,qpdf/PointerHolder, **/*.cc **/*.hh git restore include/qpdf/PointerHolder.hh git restore libtests/pointer_holder.cc cleanpatch ./format-code
2022-04-04Programmatically apply new formatting to codeJay Berkenbilt
Run this: for i in **/*.cc **/*.c **/*.h **/*.hh; do clang-format < $i >| $i.new && mv $i.new $i done
2022-03-19Remove old build filesJay Berkenbilt
2022-03-19Convert oss-fuzz-build to use cmakeJay Berkenbilt
2022-03-19Add cmake configuration filesJay Berkenbilt
2022-03-19Change handling of qpdf fuzz corpusJay Berkenbilt
Files are copied into the build area rather than left in the source tree, and the test suite looks for them there. Also remove special case around counting files in the qpdf corpus.
2022-03-05No newline for fuzz shaJay Berkenbilt
2022-02-08WHITESPACE ONLY -- expand tabs in source codeJay Berkenbilt
This comment expands all tabs using an 8-character tab-width. You should ignore this commit when using git blame or use git blame -w. In the early days, I used to use tabs where possible for indentation, since emacs did this automatically. In recent years, I have switched to only using spaces, which means qpdf source code has been a mixture of spaces and tabs. I have avoided cleaning this up because of not wanting gratuitous whitespaces change to cloud the output of git blame, but I changed my mind after discussing with users who view qpdf source code in editors/IDEs that have other tab widths by default and in light of the fact that I am planning to start applying automatic code formatting soon.
2022-02-07Update for clean compile with POINTERHOLDER_TRANSITION=2Jay Berkenbilt
2022-02-04PointerHolder: deprecate getPointer() and getRefcount()Jay Berkenbilt
Use get() and use_count() instead. Add #define NO_POINTERHOLDER_DEPRECATION to remove deprecation markers for these only. This commit also removes all deprecated PointerHolder API calls from qpdf's code except in PointerHolder's test suite, which must continue to test the deprecated APIs.
2021-12-16Remove original qpdf fuzz seed corpus from testsJay Berkenbilt
Since the introduction of fuzz testing, there has never been a problem found because of a failure of a file in the fuzzer seed corpus. As the fuzzer has found problems, they have been added to the test suite, and that should be adequate to exercise the fuzzers in the tesing environment as well as providing adequate regression testing. Removing these original files shaves many minutes off the builds in CI.
2021-11-11First increment of improving handling of weak crypto (fixes #358)Jay Berkenbilt
2021-11-04Add range check in QPDFNumberTreeObjectHelper (fuzz issue 37740)Jay Berkenbilt
2021-11-04Fix bug in merging resources /DR from foreign AcroForm (fixes #548)Jay Berkenbilt
When making resources indirect in from_dr, the code was using the wrong owning QPDF, forgetting that from_dr had already been copied using CopyForeignObject.
2021-02-10Fix loop in QPDFOutlineDocumentHelper (fuzz issue 30507)Jay Berkenbilt
2021-01-04Fix some pipelines to be safe if downstream write fails (fuzz issue 28262)Jay Berkenbilt
2021-01-02Make more QPDFPageObjectHelper methods work with form XObjectJay Berkenbilt
2021-01-02QPDFPageObjectHelper: getPageImages -> getImagesJay Berkenbilt
2020-11-21Handle negative numbers in QIntC::range_check (fuzz issue 26994)Jay Berkenbilt
2020-11-11Treat direct page as runtime rather than logic error (fuzz issue 27393)Jay Berkenbilt
2020-10-31Fix stack overflow on direct root (fuzz issue 26761)Jay Berkenbilt
2020-10-22Avoid leak by resolving object streams more than once (fuzz issue 23642)Jay Berkenbilt
2020-10-22Handle jpeg library fuzz false positivesJay Berkenbilt
The jpeg library has some assembly code that is missed by the compiler instrumentation used by memory sanitization. There is a runtime environment variable that is used to work around this issue.
2020-10-22Check for overflow in page labels (fuzz issue 23599)Jay Berkenbilt
2020-10-22Fix loop detection error (fuzz issue 23172)Jay Berkenbilt
2020-10-21Remove some fuzz files with Mal/PDFEx-H (fixes #460)Jay Berkenbilt
There isn't really an issue with these files causing a real problem, but malware and virus checkers trip on them, and the value to leaving them in the test suite is too low to be worth the hassle.
2020-10-16Rename azure-pipelines to build-scriptsJay Berkenbilt
2019-11-09Explicitly use only native crypto for oss-fuzzJay Berkenbilt
I don't need qpdf's fuzz to find leaks and invalid memory in gnutls.
2019-11-04Fix two additional fuzz test casesJay Berkenbilt
2019-09-18Fix fuzz issue 16953 (overflow checking in xref stream index)Jay Berkenbilt
2019-08-29Don't encrypt trailer, fixes fuzz issue 15983Jay Berkenbilt
Ordinarily the trailer doesn't contain any strings, so this is usually a non-issue, but if the trailer contains strings, linearizing and encrypting with object streams would include encrypted strings in the trailer, which would blow out the padding because encrypted strings are longer than their cleartext counterparts.
2019-08-28Detect stream in object stream, fixing fuzz 16214Jay Berkenbilt
It's detected in QPDFWriter instead of at parse time because I can't figure out how to construct a test case in a reasonable time. This commit moves the fuzz file into the regular test suite for a QTC coverage case.
2019-08-28Safe pipeline pop fixed fuzz issue 15445Jay Berkenbilt