Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infinite loop when parsing invalid file #103

Closed
5225225 opened this issue Sep 23, 2021 · 0 comments
Closed

Infinite loop when parsing invalid file #103

5225225 opened this issue Sep 23, 2021 · 0 comments

Comments

@5225225
Copy link
Contributor

5225225 commented Sep 23, 2021

#[test]
fn infinite_loop_invalid_file() {
    pdf::file::File::from_data(b"startxref%PDF-".as_ref()).unwrap();
}

This puts the decoder into an infinite loop, this test will never complete.

I found this by fuzzing, and the fuzzer says it was stuck in

==844227== ERROR: libFuzzer: timeout after 1 seconds
    #0 0x563a342640c1 in __sanitizer_print_stack_trace /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:87:3
    #1 0x563a349b1158 in fuzzer::PrintStackTrace() (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa7c158)
    #2 0x563a3498b47c in fuzzer::Fuzzer::AlarmCallback() (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa5647c)
    #3 0x7efddb48686f  (/usr/lib/libpthread.so.0+0x1386f)
    #4 0x563a349b9804 in __sanitizer_cov_trace_const_cmp1 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa84804)
    #5 0x563a34680d96 in pdf::parser::lexer::Lexer::next_word::hbd5751a146c5015e (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x74bd96)
    #6 0x563a3467f0d2 in pdf::parser::lexer::Lexer::next::h5e400b5eb1696032 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x74a0d2)
    #7 0x563a342efdf6 in pdf::backend::Backend::locate_xref_offset::h5009a3aff8015953 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x3badf6)
    #8 0x563a342f07c2 in pdf::backend::Backend::read_xref_table_and_trailer::h8690b18b8bcc1c0a (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x3bb7c2)
    #9 0x563a342cb3f6 in pdf::file::load_storage_and_trailer_password::h403607f8a77cc40c (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x3963f6)
    #10 0x563a342c9e7b in pdf::file::File$LT$B$GT$::load_data::h3c5cfdefdbfc04a8 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x394e7b)
    #11 0x563a3449a5f4 in rust_fuzzer_test_input (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x5655f4)
    #12 0x563a34976818 in __rust_try (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa41818)
    #13 0x563a34975f7f in LLVMFuzzerTestOneInput (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa40f7f)
    #14 0x563a3498b771 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa56771)
    #15 0x563a3497f6aa in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa4a6aa)
    #16 0x563a349836c2 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0xa4e6c2)
    #17 0x563a341df2e2 in main (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x2aa2e2)
    #18 0x7efddb181b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
    #19 0x563a341df48d in _start (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/fuzz_target_1+0x2aa48d)

when it timed out

@s3bk s3bk closed this as completed in cc59018 Sep 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant