#262: recursion on object parsing. avoid with stroing the current path as parser state and identifying cyces

Author: galkahana

PDFWriter/PDFParser.cpp

@@ -85,6 +85,7 @@ void PDFParser::ResetParser()
 	mObjectStreamsCache.clear();
 	mDecryptionHelper.Reset();
 	mParsedXrefs.clear();
+	mNewObjectParsingPath.Reset();
 
 }
 
@@ -721,16 +722,26 @@ PDFObject* PDFParser::ParseNewObject(ObjectIDType inObjectId)
 	{
 		return NULL;
 	}
-	else if(eXrefEntryExisting == mXrefTable[inObjectId].mType)
+
+	// cycle check in
+	if(mNewObjectParsingPath.EnterObject(inObjectId) != eSuccess)
+		return NULL;
+	
+	if(eXrefEntryExisting == mXrefTable[inObjectId].mType)
 	{
 		return ParseExistingInDirectObject(inObjectId);
 	}
-	else if(eXrefEntryStreamObject == mXrefTable[inObjectId].mType)
+	
+	if(eXrefEntryStreamObject == mXrefTable[inObjectId].mType)
 	{
 		return ParseExistingInDirectStreamObject(inObjectId);
 	}
-	else
+
+	// cycle check out
+	if(mNewObjectParsingPath.ExitObject(inObjectId) != eSuccess)
 		return NULL;
+
+	return NULL;	
 }
 
 ObjectIDType PDFParser::GetObjectsCount()

PDFWriter/PDFParser.h

@@ -178,6 +178,7 @@ class PDFParser
 	DecryptionHelper mDecryptionHelper;
 	InputOffsetStream mStream;
 	AdapterIByteReaderWithPositionToIReadPositionProvider mCurrentPositionProvider;
+	PDFParsingPath mNewObjectParsingPath;
 
 	// we'll use this items for bacwkards reading. might turns this into a proper stream object
 	IOBasicTypes::Byte mLinesBuffer[LINE_BUFFER_SIZE];

PDFWriter/PDFParsingPath.cpp

@@ -66,6 +66,7 @@ std::string PDFParsingPath::PrintPath() {
 
     if(it != mObjectsPath.end()) {
         pathWriter<<*it;
+        ++it;
         for(; it != mObjectsPath.end(); ++it) {
             pathWriter<<", "<<*it;
         }

PDFWriterTesting/CMakeLists.txt

@@ -114,7 +114,7 @@ endforeach ()
 file(GLOB fuzztestfiles ${CMAKE_CURRENT_SOURCE_DIR}/Materials/fuzzing/*)
 foreach (fuzztestfile ${fuzztestfiles})
     get_filename_component (TName ${fuzztestfile} NAME)
-    add_test (NAME FuzzTest_${TName} COMMAND PDFWriterTesting PDFParserFuzzSanity ${CMAKE_CURRENT_SOURCE_DIR}/Materials ${CMAKE_BINARY_DIR}/Testing/Output ${fuzztestfile})
+    add_test (NAME FuzzTest_${TName} COMMAND PDFWriterTesting PDFParserFuzzSanity ${CMAKE_CURRENT_SOURCE_DIR}/Materials ${CMAKE_BINARY_DIR}/Testing/Output ${fuzztestfile} FuzzTest_${TName}.txt)
 endforeach ()
 
 

PDFWriterTesting/Materials/fuzzing/InvalidObjectLoop.pdf

@@ -23,7 +23,7 @@ int PDFParserFuzzSanity(int argc, char* argv[]) {
     }
 
     // traces on
-    Trace::DefaultTrace().SetLogSettings(BuildRelativeOutputPath(argv,  "PDFParserFuzzSanity.txt"), true, true);
+    Trace::DefaultTrace().SetLogSettings(BuildRelativeOutputPath(argv,  argv[4]), true, true);
 
     // checks that returns, status doesn't matter
     parser.StartPDFParsing(pdfFile.GetInputStream());