Skip to content

v4.9.0

Latest
Latest

Choose a tag to compare

View all tags
@galkahana galkahana released this 29 May 15:34
· 1 commit to main since this release
v4.9.0
3242205

This new version is the result of a A major vulnerabilities research and correction project.
Naturally, Claude helped here with both uncovering and correcting many many issues.
I and the here Copilot thingy reviewed and I gotta say i'm very happy with the methodology we went through and the end result.

AI fit very well here. lots and lots of minor updates to classes, writing sanitized inputs (fonts, image files, pdfs) to verify we got a problem, and then also make sure we corrected it. Amazing.

We also upgraded the Fuzzing solution and added Sanitization capability as tooling. you can read about it in the wiki pages - Fuzz Testing, and Sanitizing.

We did also find some bugs, but TBH if no one complained i guess they are quite latent. but we did touch code that wasn't visited for 15 years (Oh my it's been some much time since i started this haha).

anyways. good fun. hope all these changes wouldn't cause trouble. Theoretically shouldn't hurt anyones code...but you know...problems can happen.

Ciao,
Gal.

What's Changed

  • feat: allow parsing numbers larger than max int, using only overflow validation on long long instead by @galkahana in #330
  • bug: file pointing to non existant object fails to copy, should just mark as non existant by @galkahana in #331
  • Fix heap overflow when hhea.numberOfHMetrics exceeds maxp.numGlyphs by @jiancanxuepiao in #332
  • fix: initialize mKey to NULL in AES decode default constructor by @galkahana in #335
  • fix: correct EOF detection in LZW decoder GetCode by @galkahana in #336
  • fix: add bounds check for LZW decoder sequence buffer by @galkahana in #334
  • fix: prevent integer overflow in TIFF predictor buffer allocation by @galkahana in #337
  • fix: include <stdint.h> for SIZE_MAX to fix Ubuntu build by @galkahana in #339
  • fix: prevent integer overflow in PNG predictor buffer allocation by @galkahana in #338
  • fix: validate pages /Count against xref size by @galkahana in #342
  • fix: bounds-check write index in TIFF predictor DecodeBufferToColors by @galkahana in #344
  • fix: add null check for LZW EarlyChange parameter by @galkahana in #340
  • fix: add null checks for Crypt filter Name parameter by @galkahana in #341
  • fix: prevent integer overflow in xref segment range by @galkahana in #343
  • feat: guard against max depth and cycle in reading parent by @galkahana in #346
  • fix: guard against cycle and max depth in PDFModifiedPage Parent walk by @galkahana in #347
  • fix: guard against cycle and max depth in PDFDocumentHandler Parent walk by @galkahana in #348
  • refactor: consolidate /Parent inheritance walks onto a single guarded helper by @galkahana in #349
  • fix: wasnt responding to report of correctly parsed photoshop tag in jpeg header parsing by @galkahana in #351
  • feat: making sure outcome of ParentCycleSanity is good by @galkahana in #352
  • fix: Type 1 Subrs OOB primitive (V-052/053/054/056) by @galkahana in #353
  • fix: CFF INDEX offset table sanity (V-033/034/036/037) by @galkahana in #354
  • Add GitHub Copilot review instructions by @galkahana in #355
  • fix: Type 2 charstring operand-stack bounds (V-027/028) by @galkahana in #356
  • fix: Type 1 callothersubr operand-stack bounds (V-057/V-058) by @galkahana in #357
  • fix: CFF DICT operand-list bounds (V-041) by @galkahana in #358
  • fix: Type 1 PostScript-token helper boundary checks (V-060/V-071) by @galkahana in #359
  • fix: OpenType primitive reader stale outValue (V-017/V-026) by @galkahana in #360
  • fix: CFF primitive reader stale outValue (V-043/V-050) by @galkahana in #361
  • fix: Type 1 charstring decode stream stale outValue (V-055) by @galkahana in #362
  • fix: OpenType ReadHMtx numberOfHMetrics-zero guard (V-021) by @galkahana in #363
  • fix: CFF FDSelect bounds + Encoding overflow + supplements seek (V-030/V-031/V-032) by @galkahana in #364
  • fix: TrueType composite-glyph walker rejects cyclic dependencies (V-018) by @galkahana in #365
  • fix: CFF/Type1 seac dependency walkers reject cyclic & deep chains (V-085/V-086) by @galkahana in #366
  • fix: FreeType wrapper return-code handling (V-076/077/078/082/083) by @galkahana in #367
  • feat: update bot review instructions to be more focused on actionable items resulting from review by @galkahana in #368
  • fix: initialize OpenTypeFileInput uninit members (V-020/V-022) by @galkahana in #369
  • fix: initialize InputPFBDecodeStream uninit ctor members (V-062) by @galkahana in #370
  • fix: initialize FreeTypeFaceWrapper mCurrentGlyph (V-080) by @galkahana in #371
  • fix: initialize CFFFileInput mFontsCount/mStringsCount (V-040) by @galkahana in #372
  • feat: more reviewer instructions - make sure to always include verdict by @galkahana in #373
  • fix: check token presence in Type1 dict parsers; default Reset metrics (V-072, V-089) by @galkahana in #374
  • fix: cross PFB segment boundaries in the tokenizer (V-090) by @galkahana in #375
  • fix: FreeTypeFaceWrapper format/charmap/classifier correctness (V-079/V-081/V-084) by @galkahana in #382
  • fix: FreeTypeWrapper FreeType-boundary memory hygiene (V-073/V-074/V-075) by @galkahana in #381
  • fix: assemble PFB segment length in 64-bit, no signed-shift UB (V-061) by @galkahana in #380
  • fix: harden Type1Input charstring parsing + null guards (V-067/V-068/V-069) by @galkahana in #379
  • conf: updating instructions, wasn't getting table by @galkahana in #383
  • fix: guard CharString interpreter operand misuse (V-029/V-059) by @galkahana in #378
  • fix: CFF charset OOB write + ReadCharString double-free (V-044/V-047/V-048) by @galkahana in #377
  • fix: bound SFNT recursion + validate name/loca table ranges (V-019/V-023/V-024/V-025) by @galkahana in #376
  • fix: SafeParse helpers replace BoxingBase string-ctor parses (V-064) by @galkahana in #384
  • fix: bound CFF narrowing casts (V-038/V-045/V-049) by @galkahana in #385
  • fix: bound JPEG marker/Exif arithmetic (V-093..V-098) by @galkahana in #386
  • fix: clear SOFMarkerNotFound only after successful read (V-099) by @galkahana in #388
  • fix: bound TIFF YCBCR realloc, add break on palette OOM (V-100/V-101) by @galkahana in #389
  • fix: bound TIFF size calcs + check TIFFGetField returns (V-102..V-105) by @galkahana in #390
  • fix: memmove + stripsize underflow + palette bounds in TIFF (V-106..V-108) by @galkahana in #391
  • cleanup: drop dead palette-realize path in TIFFImageHandler by @galkahana in #392
  • cleanup: dedup PNG handler init + drop keep_unknown_chunks by @galkahana in #393
  • cleanup: NULL-check catalogDict before GetIterator in modified-doc catalog write by @galkahana in #394
  • fix: return actual status from WriteDictionaryObject on copy failure by @galkahana in #395
  • fix: delete streamReader on dictionary-write failure in WriteStreamObject by @galkahana in #396
  • fix: cap recursion depth in PDFDocumentHandler::WriteObjectByType by @galkahana in #397
  • fix: clear mMorePageEndTasks in Cleanup + propagate WriteResourcesDictionary status by @galkahana in #398
  • fix: bound Trace::TraceToLog output via vsnprintf by @galkahana in #399
  • fix: reject TIFFs whose declared decoded size dwarfs strip bytecount by @galkahana in #400
  • Change branch name from 'master' to 'main' by @galkahana in #402
  • build: add PDFHUMMUS_SANITIZER opt-in build option by @galkahana in #403
  • Change pull request branch from 'master' to 'main' by @galkahana in #401
  • build: fuzz harness foundation — extend PDFParser depth + add JPEG harness by @galkahana in #404
  • build: TIFF fuzz harness + JPEG dict by @galkahana in #405
  • build: instrument PDFWriter + bundled deps when fuzzing is enabled by @galkahana in #406
  • build: stream-filter fuzz harnesses (flate, lzw, AES) by @galkahana in #407
  • build: font fuzz harnesses (OpenType, CFF) — completes §5.3 by @galkahana in #408

New Contributors

Full Changelog: v4.8.1...v4.9.0

Contributors

galkahana and jiancanxuepiao
Assets 2
Loading