Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Panic - attempt to multiply with overflow - with overflow checks enabled #236

Open
qarmin opened this issue Oct 19, 2024 · 1 comment
Open

Comments

@qarmin
Copy link

qarmin commented Oct 19, 2024

File content is binary, so is available only in zip file

command

timeout -v 100 pdf_rs TEST___FILE.pdf

from crate - https://github.com/qarmin/Automated-Fuzzer/blob/master/src/crates/pdf_rs/src/main.rs

App was compiled with nightly rust compiler to be able to use address sanitizer
(You can ignore this part if there is no address sanitizer error)
On Ubuntu 24.04, the commands to compile were:

rustup default nightly
rustup component add rust-src --toolchain nightly-x86_64-unknown-linux-gnu
rustup component add llvm-tools-preview --toolchain nightly-x86_64-unknown-linux-gnu

export RUST_BACKTRACE=1 # or full depending on project
export ASAN_SYMBOLIZER_PATH=$(which llvm-symbolizer-18)
export ASAN_OPTIONS=symbolize=1
RUSTFLAGS="-Zsanitizer=address" cargo +nightly build --target x86_64-unknown-linux-gnu

cause this

thread 'main' panicked at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:173:13:
attempt to multiply with overflow
stack backtrace:
   0: rust_begin_unwind
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/std/src/panicking.rs:665:5
   1: core::panicking::panic_fmt
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/core/src/panicking.rs:74:14
   2: core::panicking::panic_const::panic_const_mul_overflow
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/core/src/panicking.rs:181:21
   3: pdf::enc::word_85
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:173:13
   4: pdf::enc::decode_85
   5: pdf::enc::decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:464:40
   6: pdf::file::Storage<B,OC,SC,L>::decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:145:23
   7: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get_data_or_decode::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:352:57
   8: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
   9: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  10: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get_data_or_decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:352:9
  11: pdf::object::stream::Stream<I>::data
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/stream.rs:89:17
  12: pdf::object::color::ColorSpace::from_primitive_depth
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/color.rs:113:28
  13: <pdf::object::color::ColorSpace as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/color.rs:74:9
  14: <std::collections::hash::map::HashMap<pdf::primitive::Name,V> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:660:45
  15: <pdf::object::types::Resources as pdf::object::FromDict>::from_dict
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:371:10
  16: <pdf::object::types::Resources as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:371:10
  17: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:50
  18: core::result::Result<T,E>::and_then
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1347:22
  19: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:37
  20: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
  21: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  22: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:321:19
  23: <pdf::object::MaybeRef<T> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:344:59
  24: <core::option::Option<T> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:692:24
  25: <pdf::object::types::Page as pdf::object::FromDict>::from_dict
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:264:10
  26: <pdf::object::types::PagesNode as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:25:45
  27: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:50
  28: core::result::Result<T,E>::and_then
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1347:22
  29: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:37
  30: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
  31: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  32: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:321:19
  33: pdf::object::types::PageTree::page_limited
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:206:24
  34: pdf::object::types::PageTree::page_limited
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:210:32
  35: pdf::object::types::PageTree::page
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:198:9
  36: pdf::file::File<B,OC,SC,L>::get_page
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:640:9
  37: pdf_rs::check_file
             at ./src/crates/pdf_rs/src/main.rs:29:35
  38: pdf_rs::main
             at ./src/crates/pdf_rs/src/main.rs:21:9
  39: core::ops::function::FnOnce::call_once
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

##### Automatic Fuzzer note, output status "None", output signal "Some(6)"

compressed.zip

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants
@qarmin and others