| OLD | NEW |
| 1 // Copyright 2016 The PDFium Authors. All rights reserved. | 1 // Copyright 2016 The PDFium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <cstdint> | 5 #include <cstdint> |
| 6 | 6 |
| 7 #include "core/fpdfapi/parser/cpdf_array.h" |
| 7 #include "core/fpdfapi/parser/cpdf_dictionary.h" | 8 #include "core/fpdfapi/parser/cpdf_dictionary.h" |
| 8 #include "core/fpdfapi/parser/cpdf_hint_tables.h" | 9 #include "core/fpdfapi/parser/cpdf_hint_tables.h" |
| 9 | 10 #include "core/fpdfapi/parser/cpdf_linearized.h" |
| 10 struct DummyLinearizedDictionary { | 11 #include "third_party/base/ptr_util.h" |
| 11 int end_of_first_page_offset; | |
| 12 int number_of_pages; | |
| 13 int first_page_object_number; | |
| 14 int first_page_number; | |
| 15 int primary_hint_stream_offset; | |
| 16 int primary_hint_stream_length; | |
| 17 int shared_hint_table_offset; | |
| 18 }; | |
| 19 | 12 |
| 20 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { | 13 int32_t GetData(const int32_t** data32, const uint8_t** data, size_t* size) { |
| 21 const int32_t* ret = *data32; | 14 const int32_t* ret = *data32; |
| 22 ++(*data32); | 15 ++(*data32); |
| 23 *data += 4; | 16 *data += 4; |
| 24 *size -= 4; | 17 *size -= 4; |
| 25 return *ret; | 18 return *ret; |
| 26 } | 19 } |
| 27 | 20 |
| 28 class HintTableForFuzzing : public CPDF_HintTables { | 21 class HintTableForFuzzing : public CPDF_HintTables { |
| 29 public: | 22 public: |
| 30 HintTableForFuzzing(DummyLinearizedDictionary* dict, | 23 HintTableForFuzzing(CPDF_Linearized* pLinearized, |
| 31 CPDF_Dictionary* linearized_dict) | 24 int shared_hint_table_offset) |
| 32 : CPDF_HintTables(nullptr, linearized_dict), dict_(dict) {} | 25 : CPDF_HintTables(nullptr, pLinearized), |
| 26 shared_hint_table_offset_(shared_hint_table_offset) {} |
| 33 ~HintTableForFuzzing() {} | 27 ~HintTableForFuzzing() {} |
| 34 | 28 |
| 35 void Fuzz(const uint8_t* data, size_t size) { | 29 void Fuzz(const uint8_t* data, size_t size) { |
| 36 if (dict_->shared_hint_table_offset <= 0) | 30 if (shared_hint_table_offset_ <= 0) |
| 37 return; | 31 return; |
| 38 | 32 |
| 39 if (size < static_cast<size_t>(dict_->shared_hint_table_offset)) | 33 if (size < static_cast<size_t>(shared_hint_table_offset_)) |
| 40 return; | 34 return; |
| 41 | 35 |
| 42 CFX_BitStream bs; | 36 CFX_BitStream bs; |
| 43 bs.Init(data, size); | 37 bs.Init(data, size); |
| 44 if (!ReadPageHintTable(&bs)) | 38 if (!ReadPageHintTable(&bs)) |
| 45 return; | 39 return; |
| 46 ReadSharedObjHintTable(&bs, dict_->shared_hint_table_offset); | 40 ReadSharedObjHintTable(&bs, shared_hint_table_offset_); |
| 47 } | 41 } |
| 48 | 42 |
| 49 private: | 43 private: |
| 50 int GetEndOfFirstPageOffset() const override { | 44 int shared_hint_table_offset_; |
| 51 return dict_->end_of_first_page_offset; | 45 }; |
| 52 } | |
| 53 int GetNumberOfPages() const override { return dict_->number_of_pages; } | |
| 54 int GetFirstPageObjectNumber() const override { | |
| 55 return dict_->first_page_object_number; | |
| 56 } | |
| 57 int GetFirstPageNumber() const override { return dict_->first_page_number; } | |
| 58 int ReadPrimaryHintStreamOffset() const override { | |
| 59 return dict_->primary_hint_stream_offset; | |
| 60 } | |
| 61 int ReadPrimaryHintStreamLength() const override { | |
| 62 return dict_->primary_hint_stream_length; | |
| 63 } | |
| 64 | 46 |
| 65 DummyLinearizedDictionary* const dict_; | 47 class FakeLinearized : public CPDF_Linearized { |
| 48 public: |
| 49 explicit FakeLinearized(CPDF_Dictionary* linearized_dict) |
| 50 : CPDF_Linearized(linearized_dict) {} |
| 66 }; | 51 }; |
| 67 | 52 |
| 68 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | 53 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { |
| 69 // Need 28 bytes for |dummy_dict|. | 54 // Need 28 bytes for |linearized_dict|. |
| 70 // The header section of page offset hint table is 36 bytes. | 55 // The header section of page offset hint table is 36 bytes. |
| 71 // The header section of shared object hint table is 24 bytes. | 56 // The header section of shared object hint table is 24 bytes. |
| 72 if (size < 28 + 36 + 24) | 57 if (size < 28 + 36 + 24) |
| 73 return 0; | 58 return 0; |
| 74 | 59 |
| 75 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); | 60 const int32_t* data32 = reinterpret_cast<const int32_t*>(data); |
| 76 DummyLinearizedDictionary dummy_dict; | |
| 77 dummy_dict.end_of_first_page_offset = GetData(&data32, &data, &size); | |
| 78 dummy_dict.number_of_pages = GetData(&data32, &data, &size); | |
| 79 dummy_dict.first_page_object_number = GetData(&data32, &data, &size); | |
| 80 dummy_dict.first_page_number = GetData(&data32, &data, &size); | |
| 81 dummy_dict.primary_hint_stream_offset = GetData(&data32, &data, &size); | |
| 82 dummy_dict.primary_hint_stream_length = GetData(&data32, &data, &size); | |
| 83 dummy_dict.shared_hint_table_offset = GetData(&data32, &data, &size); | |
| 84 | 61 |
| 85 std::unique_ptr<CPDF_Dictionary> dummy_linearized_dict(new CPDF_Dictionary); | 62 auto linearized_dict = pdfium::MakeUnique<CPDF_Dictionary>(); |
| 63 // Set initial value. |
| 64 linearized_dict->SetBooleanFor("Linearized", true); |
| 65 // Set first page end offset |
| 66 linearized_dict->SetIntegerFor("E", GetData(&data32, &data, &size)); |
| 67 // Set page count |
| 68 linearized_dict->SetIntegerFor("N", GetData(&data32, &data, &size)); |
| 69 // Set first page obj num |
| 70 linearized_dict->SetIntegerFor("O", GetData(&data32, &data, &size)); |
| 71 // Set first page no |
| 72 linearized_dict->SetIntegerFor("P", GetData(&data32, &data, &size)); |
| 73 |
| 74 auto hint_info = pdfium::MakeUnique<CPDF_Array>(); |
| 75 // Add primary hint stream offset |
| 76 hint_info->AddInteger(GetData(&data32, &data, &size)); |
| 77 // Add primary hint stream size |
| 78 hint_info->AddInteger(GetData(&data32, &data, &size)); |
| 79 // Set hint stream info. |
| 80 linearized_dict->SetFor("H", hint_info.release()); |
| 81 |
| 82 const int shared_hint_table_offset = GetData(&data32, &data, &size); |
| 83 |
| 86 { | 84 { |
| 87 HintTableForFuzzing hint_table(&dummy_dict, dummy_linearized_dict.get()); | 85 FakeLinearized linearized(linearized_dict.get()); |
| 86 HintTableForFuzzing hint_table(&linearized, shared_hint_table_offset); |
| 88 hint_table.Fuzz(data, size); | 87 hint_table.Fuzz(data, size); |
| 89 } | 88 } |
| 90 return 0; | 89 return 0; |
| 91 } | 90 } |
| OLD | NEW |