From b0860beccd6a4a8d9f8ea3dbba392a3a13218ad3 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Wed, 23 Aug 2017 15:33:07 -0700 Subject: Limit pdf_jpx_fuzzer memory usage. BUG=chromium:738711 Change-Id: I4a308694c3e6fcd17431515b7897969d54486071 Reviewed-on: https://pdfium-review.googlesource.com/11870 Commit-Queue: dsinclair Reviewed-by: Henrique Nakashima Reviewed-by: dsinclair --- testing/libfuzzer/pdf_jpx_fuzzer.cc | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'testing') diff --git a/testing/libfuzzer/pdf_jpx_fuzzer.cc b/testing/libfuzzer/pdf_jpx_fuzzer.cc index b48c14068c..88d82abb80 100644 --- a/testing/libfuzzer/pdf_jpx_fuzzer.cc +++ b/testing/libfuzzer/pdf_jpx_fuzzer.cc @@ -8,6 +8,7 @@ #include "core/fxcodec/codec/cjpx_decoder.h" #include "core/fxcodec/codec/codec_int.h" +#include "core/fxcrt/fx_safe_types.h" #include "core/fxge/dib/cfx_dibitmap.h" #include "core/fxge/fx_dib.h" @@ -24,6 +25,13 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { uint32_t components; g_module.GetImageInfo(decoder.get(), &width, &height, &components); + static constexpr uint32_t kMemLimit = 1024 * 1024 * 1024; // 1 GB. + FX_SAFE_UINT32 mem = width; + mem *= height; + mem *= components; + if (!mem.IsValid() || mem.ValueOrDie() > kMemLimit) + return 0; + FXDIB_Format format; if (components == 1) { format = FXDIB_8bppRgb; -- cgit v1.2.3