diff options
| -rw-r--r-- | testing/fuzzers/BUILD.gn | 37 | ||||
| -rw-r--r-- | testing/fuzzers/pdfium_fuzzer.cc | 21 | ||||
| -rw-r--r-- | testing/fuzzers/pdfium_fuzzer_helper.cc | 264 | ||||
| -rw-r--r-- | testing/fuzzers/pdfium_fuzzer_helper.h | 25 | ||||
| -rw-r--r-- | testing/fuzzers/pdfium_xfa_fuzzer.cc | 31 |
5 files changed, 378 insertions, 0 deletions
diff --git a/testing/fuzzers/BUILD.gn b/testing/fuzzers/BUILD.gn index 59211b1758..5a6af69f69 100644 --- a/testing/fuzzers/BUILD.gn +++ b/testing/fuzzers/BUILD.gn @@ -35,6 +35,7 @@ group("fuzzers") { ":pdf_psengine_fuzzer_src", ":pdf_streamparser_fuzzer_src", ":pdf_xml_fuzzer_src", + ":pdfium_fuzzer_src", ] if (pdf_enable_xfa) { deps += [ @@ -44,6 +45,7 @@ group("fuzzers") { ":pdf_css_fuzzer_src", ":pdf_fm2js_fuzzer_src", ":pdf_formcalc_fuzzer_src", + ":pdfium_xfa_fuzzer_src", ] if (pdf_enable_xfa_bmp) { deps += [ ":pdf_codec_bmp_fuzzer_src" ] @@ -78,6 +80,9 @@ template("pdfium_fuzzer") { "//build/config/compiler:no_chromium_code", ":fuzzer_config", ] + if (pdf_enable_v8) { + configs += [ "//v8:external_startup_data" ] + } } } @@ -175,6 +180,19 @@ if (pdf_enable_xfa) { "pdf_formcalc_fuzzer.cc", ] } + + pdfium_fuzzer("pdfium_xfa_fuzzer_src") { + sources = [ + "pdfium_fuzzer_helper.cc", + "pdfium_fuzzer_helper.h", + "pdfium_xfa_fuzzer.cc", + ] + deps = [ + "../../:test_support", + "//v8", + "//v8:v8_libplatform", + ] + } } pdfium_fuzzer("pdf_cmap_fuzzer_src") { @@ -251,3 +269,22 @@ pdfium_fuzzer("pdf_xml_fuzzer_src") { "pdf_xml_fuzzer.cc", ] } + +pdfium_fuzzer("pdfium_fuzzer_src") { + sources = [ + "pdfium_fuzzer.cc", + "pdfium_fuzzer_helper.cc", + "pdfium_fuzzer_helper.h", + ] + + deps = [ + "../../:test_support", + ] + + if (pdf_enable_v8) { + deps += [ + "//v8", + "//v8:v8_libplatform", + ] + } +} diff --git a/testing/fuzzers/pdfium_fuzzer.cc b/testing/fuzzers/pdfium_fuzzer.cc new file mode 100644 index 0000000000..dc15378ac5 --- /dev/null +++ b/testing/fuzzers/pdfium_fuzzer.cc @@ -0,0 +1,21 @@ +// Copyright 2017 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include <stdint.h> + +#include "testing/fuzzers/pdfium_fuzzer_helper.h" + +class PDFiumFuzzer : public PDFiumFuzzerHelper { + public: + PDFiumFuzzer() = default; + ~PDFiumFuzzer() override = default; + + int GetFormCallbackVersion() const override { return 1; } +}; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + PDFiumFuzzer fuzzer; + fuzzer.RenderPdf(reinterpret_cast<const char*>(data), size); + return 0; +} diff --git a/testing/fuzzers/pdfium_fuzzer_helper.cc b/testing/fuzzers/pdfium_fuzzer_helper.cc new file mode 100644 index 0000000000..ed000d251d --- /dev/null +++ b/testing/fuzzers/pdfium_fuzzer_helper.cc @@ -0,0 +1,264 @@ +// Copyright 2017 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include "testing/fuzzers/pdfium_fuzzer_helper.h" + +#include <assert.h> +#include <limits.h> + +#include <stddef.h> +#include <stdint.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#ifdef _WIN32 +#include <Windows.h> +#elif defined(__APPLE__) +#include <mach-o/dyld.h> +#else // Linux +#include <unistd.h> +#endif // _WIN32 + +#include <memory> +#include <sstream> +#include <string> +#include <utility> + +#include "public/cpp/fpdf_scopers.h" +#include "public/fpdf_dataavail.h" +#include "public/fpdf_ext.h" +#include "public/fpdf_text.h" +#include "testing/test_support.h" +#include "v8/include/v8-platform.h" +#include "v8/include/v8.h" + +namespace { + +int ExampleAppAlert(IPDF_JSPLATFORM*, + FPDF_WIDESTRING, + FPDF_WIDESTRING, + int, + int) { + return 0; +} + +int ExampleAppResponse(IPDF_JSPLATFORM*, + FPDF_WIDESTRING question, + FPDF_WIDESTRING title, + FPDF_WIDESTRING default_value, + FPDF_WIDESTRING label, + FPDF_BOOL is_password, + void* response, + int length) { + // UTF-16, always LE regardless of platform. + uint8_t* ptr = static_cast<uint8_t*>(response); + ptr[0] = 'N'; + ptr[1] = 0; + ptr[2] = 'o'; + ptr[3] = 0; + return 4; +} + +void ExampleDocGotoPage(IPDF_JSPLATFORM*, int pageNumber) {} + +void ExampleDocMail(IPDF_JSPLATFORM*, + void* mailData, + int length, + FPDF_BOOL UI, + FPDF_WIDESTRING To, + FPDF_WIDESTRING Subject, + FPDF_WIDESTRING CC, + FPDF_WIDESTRING BCC, + FPDF_WIDESTRING Msg) {} + +void ExampleUnsupportedHandler(UNSUPPORT_INFO*, int type) {} + +FPDF_BOOL Is_Data_Avail(FX_FILEAVAIL* pThis, size_t offset, size_t size) { + return true; +} + +void Add_Segment(FX_DOWNLOADHINTS* pThis, size_t offset, size_t size) {} + +#ifdef PDF_ENABLE_V8 +std::string ProgramPath() { + std::string result; + +#ifdef _WIN32 + char path[MAX_PATH]; + DWORD len = GetModuleFileNameA(NULL, path, MAX_PATH); + if (len != 0) + result = std::string(path, len); +#elif defined(__APPLE__) + char path[PATH_MAX]; + unsigned int len = PATH_MAX; + if (!_NSGetExecutablePath(path, &len)) { + std::unique_ptr<char, pdfium::FreeDeleter> resolved_path( + realpath(path, nullptr)); + if (resolved_path.get()) + result = std::string(resolved_path.get()); + } +#else // Linux + char path[PATH_MAX]; + ssize_t len = readlink("/proc/self/exe", path, PATH_MAX); + if (len > 0) + result = std::string(path, len); +#endif + return result; +} +#endif // PDF_ENABLE_V8 + +} // namespace + +PDFiumFuzzerHelper::PDFiumFuzzerHelper() = default; + +PDFiumFuzzerHelper::~PDFiumFuzzerHelper() = default; + +bool PDFiumFuzzerHelper::OnFormFillEnvLoaded(FPDF_DOCUMENT doc) { + return true; +} + +void PDFiumFuzzerHelper::RenderPdf(const char* pBuf, size_t len) { + IPDF_JSPLATFORM platform_callbacks; + memset(&platform_callbacks, '\0', sizeof(platform_callbacks)); + platform_callbacks.version = 3; + platform_callbacks.app_alert = ExampleAppAlert; + platform_callbacks.app_response = ExampleAppResponse; + platform_callbacks.Doc_gotoPage = ExampleDocGotoPage; + platform_callbacks.Doc_mail = ExampleDocMail; + + FPDF_FORMFILLINFO form_callbacks; + memset(&form_callbacks, '\0', sizeof(form_callbacks)); + form_callbacks.version = GetFormCallbackVersion(); + form_callbacks.m_pJsPlatform = &platform_callbacks; + + TestLoader loader(pBuf, len); + FPDF_FILEACCESS file_access; + memset(&file_access, '\0', sizeof(file_access)); + file_access.m_FileLen = static_cast<unsigned long>(len); + file_access.m_GetBlock = TestLoader::GetBlock; + file_access.m_Param = &loader; + + FX_FILEAVAIL file_avail; + memset(&file_avail, '\0', sizeof(file_avail)); + file_avail.version = 1; + file_avail.IsDataAvail = Is_Data_Avail; + + FX_DOWNLOADHINTS hints; + memset(&hints, '\0', sizeof(hints)); + hints.version = 1; + hints.AddSegment = Add_Segment; + + ScopedFPDFAvail pdf_avail(FPDFAvail_Create(&file_avail, &file_access)); + + int nRet = PDF_DATA_NOTAVAIL; + bool bIsLinearized = false; + ScopedFPDFDocument doc; + if (FPDFAvail_IsLinearized(pdf_avail.get()) == PDF_LINEARIZED) { + doc.reset(FPDFAvail_GetDocument(pdf_avail.get(), nullptr)); + if (doc) { + while (nRet == PDF_DATA_NOTAVAIL) + nRet = FPDFAvail_IsDocAvail(pdf_avail.get(), &hints); + + if (nRet == PDF_DATA_ERROR) + return; + + nRet = FPDFAvail_IsFormAvail(pdf_avail.get(), &hints); + if (nRet == PDF_FORM_ERROR || nRet == PDF_FORM_NOTAVAIL) + return; + + bIsLinearized = true; + } + } else { + doc.reset(FPDF_LoadCustomDocument(&file_access, nullptr)); + } + + if (!doc) + return; + + (void)FPDF_GetDocPermissions(doc.get()); + + ScopedFPDFFormHandle form( + FPDFDOC_InitFormFillEnvironment(doc.get(), &form_callbacks)); + if (!OnFormFillEnvLoaded(doc.get())) + return; + + FPDF_SetFormFieldHighlightColor(form.get(), FPDF_FORMFIELD_UNKNOWN, 0xFFE4DD); + FPDF_SetFormFieldHighlightAlpha(form.get(), 100); + FORM_DoDocumentJSAction(form.get()); + FORM_DoDocumentOpenAction(form.get()); + + int page_count = FPDF_GetPageCount(doc.get()); + for (int i = 0; i < page_count; ++i) { + if (bIsLinearized) { + nRet = PDF_DATA_NOTAVAIL; + while (nRet == PDF_DATA_NOTAVAIL) + nRet = FPDFAvail_IsPageAvail(pdf_avail.get(), i, &hints); + + if (nRet == PDF_DATA_ERROR) + return; + } + RenderPage(doc.get(), form.get(), i); + } + FORM_DoDocumentAAction(form.get(), FPDFDOC_AACTION_WC); +} + +bool PDFiumFuzzerHelper::RenderPage(FPDF_DOCUMENT doc, + FPDF_FORMHANDLE form, + const int page_index) { + ScopedFPDFPage page(FPDF_LoadPage(doc, page_index)); + if (!page) + return false; + + ScopedFPDFTextPage text_page(FPDFText_LoadPage(page.get())); + FORM_OnAfterLoadPage(page.get(), form); + FORM_DoPageAAction(page.get(), form, FPDFPAGE_AACTION_OPEN); + + const double scale = 1.0; + int width = static_cast<int>(FPDF_GetPageWidth(page.get()) * scale); + int height = static_cast<int>(FPDF_GetPageHeight(page.get()) * scale); + ScopedFPDFBitmap bitmap(FPDFBitmap_Create(width, height, 0)); + if (bitmap) { + FPDFBitmap_FillRect(bitmap.get(), 0, 0, width, height, 0xFFFFFFFF); + FPDF_RenderPageBitmap(bitmap.get(), page.get(), 0, 0, width, height, 0, 0); + FPDF_FFLDraw(form, bitmap.get(), page.get(), 0, 0, width, height, 0, 0); + } + FORM_DoPageAAction(page.get(), form, FPDFPAGE_AACTION_CLOSE); + FORM_OnBeforeClosePage(page.get(), form); + return !!bitmap; +} + +// Initialize the library once for all runs of the fuzzer. +struct TestCase { + TestCase() { +#ifdef PDF_ENABLE_V8 +#ifdef V8_USE_EXTERNAL_STARTUP_DATA + platform = InitializeV8ForPDFiumWithStartupData( + ProgramPath(), "", &natives_blob, &snapshot_blob); +#else + platform = InitializeV8ForPDFium(ProgramPath()); +#endif // V8_USE_EXTERNAL_STARTUP_DATA +#endif // PDF_ENABLE_V8 + + memset(&config, '\0', sizeof(config)); + config.version = 2; + config.m_pUserFontPaths = nullptr; + config.m_pIsolate = nullptr; + config.m_v8EmbedderSlot = 0; + FPDF_InitLibraryWithConfig(&config); + + memset(&unsupport_info, '\0', sizeof(unsupport_info)); + unsupport_info.version = 1; + unsupport_info.FSDK_UnSupport_Handler = ExampleUnsupportedHandler; + FSDK_SetUnSpObjProcessHandler(&unsupport_info); + } + + std::unique_ptr<v8::Platform> platform; + v8::StartupData natives_blob; + v8::StartupData snapshot_blob; + FPDF_LIBRARY_CONFIG config; + UNSUPPORT_INFO unsupport_info; +}; + +static TestCase* test_case = new TestCase(); diff --git a/testing/fuzzers/pdfium_fuzzer_helper.h b/testing/fuzzers/pdfium_fuzzer_helper.h new file mode 100644 index 0000000000..f9db00fa64 --- /dev/null +++ b/testing/fuzzers/pdfium_fuzzer_helper.h @@ -0,0 +1,25 @@ +// Copyright 2017 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef TESTING_FUZZERS_PDFIUM_FUZZER_HELPER_H_ +#define TESTING_FUZZERS_PDFIUM_FUZZER_HELPER_H_ + +#include "public/fpdfview.h" + +class PDFiumFuzzerHelper { + public: + void RenderPdf(const char* pBuf, size_t len); + + virtual int GetFormCallbackVersion() const = 0; + virtual bool OnFormFillEnvLoaded(FPDF_DOCUMENT doc); + + protected: + PDFiumFuzzerHelper(); + virtual ~PDFiumFuzzerHelper(); + + private: + bool RenderPage(FPDF_DOCUMENT doc, FPDF_FORMHANDLE form, int page_index); +}; + +#endif // TESTING_FUZZERS_PDFIUM_FUZZER_HELPER_H_ diff --git a/testing/fuzzers/pdfium_xfa_fuzzer.cc b/testing/fuzzers/pdfium_xfa_fuzzer.cc new file mode 100644 index 0000000000..f9a69d4166 --- /dev/null +++ b/testing/fuzzers/pdfium_xfa_fuzzer.cc @@ -0,0 +1,31 @@ +// Copyright 2017 The Chromium Authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#include <stdint.h> + +#include "public/fpdf_formfill.h" +#include "testing/fuzzers/pdfium_fuzzer_helper.h" + +class PDFiumXFAFuzzer : public PDFiumFuzzerHelper { + public: + PDFiumXFAFuzzer() = default; + ~PDFiumXFAFuzzer() override = default; + + int GetFormCallbackVersion() const override { return 2; } + + // Return false if XFA doesn't load as otherwise we're duplicating the work + // done by the non-xfa fuzzer. + bool OnFormFillEnvLoaded(FPDF_DOCUMENT doc) override { + int form_type = FPDF_GetFormType(doc); + if (form_type != FORMTYPE_XFA_FULL && form_type != FORMTYPE_XFA_FOREGROUND) + return false; + return FPDF_LoadXFA(doc); + } +}; + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + PDFiumXFAFuzzer fuzzer; + fuzzer.RenderPdf(reinterpret_cast<const char*>(data), size); + return 0; +} |