Skip to content

Panic - attempt to multiply with overflow - with overflow checks enabled #236

Open
@qarmin

Description

@qarmin

File content is binary, so is available only in zip file

command

timeout -v 100 pdf_rs TEST___FILE.pdf

from crate - https://github.com/qarmin/Automated-Fuzzer/blob/master/src/crates/pdf_rs/src/main.rs

App was compiled with nightly rust compiler to be able to use address sanitizer
(You can ignore this part if there is no address sanitizer error)
On Ubuntu 24.04, the commands to compile were:

rustup default nightly
rustup component add rust-src --toolchain nightly-x86_64-unknown-linux-gnu
rustup component add llvm-tools-preview --toolchain nightly-x86_64-unknown-linux-gnu

export RUST_BACKTRACE=1 # or full depending on project
export ASAN_SYMBOLIZER_PATH=$(which llvm-symbolizer-18)
export ASAN_OPTIONS=symbolize=1
RUSTFLAGS="-Zsanitizer=address" cargo +nightly build --target x86_64-unknown-linux-gnu

cause this

thread 'main' panicked at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:173:13:
attempt to multiply with overflow
stack backtrace:
   0: rust_begin_unwind
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/std/src/panicking.rs:665:5
   1: core::panicking::panic_fmt
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/core/src/panicking.rs:74:14
   2: core::panicking::panic_const::panic_const_mul_overflow
             at /rustc/e92993dbb43f0a5d17fe56e2d82f90435d6521c8/library/core/src/panicking.rs:181:21
   3: pdf::enc::word_85
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:173:13
   4: pdf::enc::decode_85
   5: pdf::enc::decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/enc.rs:464:40
   6: pdf::file::Storage<B,OC,SC,L>::decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:145:23
   7: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get_data_or_decode::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:352:57
   8: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
   9: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  10: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get_data_or_decode
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:352:9
  11: pdf::object::stream::Stream<I>::data
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/stream.rs:89:17
  12: pdf::object::color::ColorSpace::from_primitive_depth
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/color.rs:113:28
  13: <pdf::object::color::ColorSpace as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/color.rs:74:9
  14: <std::collections::hash::map::HashMap<pdf::primitive::Name,V> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:660:45
  15: <pdf::object::types::Resources as pdf::object::FromDict>::from_dict
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:371:10
  16: <pdf::object::types::Resources as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:371:10
  17: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:50
  18: core::result::Result<T,E>::and_then
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1347:22
  19: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:37
  20: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
  21: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  22: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:321:19
  23: <pdf::object::MaybeRef<T> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:344:59
  24: <core::option::Option<T> as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/mod.rs:692:24
  25: <pdf::object::types::Page as pdf::object::FromDict>::from_dict
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:264:10
  26: <pdf::object::types::PagesNode as pdf::object::Object>::from_primitive
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:25:45
  27: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:50
  28: core::result::Result<T,E>::and_then
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/result.rs:1347:22
  29: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get::{{closure}}
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:322:37
  30: globalcache::sync::SyncCache<K,V>::get
             at /home/runner/.cargo/registry/src/index.crates.io-6f17d22bba15001f/globalcache-0.2.4/src/sync.rs:71:29
  31: <alloc::sync::Arc<globalcache::sync::SyncCache<pdf::object::PlainRef,T>> as pdf::file::Cache<T>>::get_or_compute
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:55:9
  32: <pdf::file::StorageResolver<B,OC,SC,L> as pdf::object::Resolve>::get
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:321:19
  33: pdf::object::types::PageTree::page_limited
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:206:24
  34: pdf::object::types::PageTree::page_limited
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:210:32
  35: pdf::object::types::PageTree::page
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/object/types.rs:198:9
  36: pdf::file::File<B,OC,SC,L>::get_page
             at /home/runner/.cargo/git/checkouts/pdf-3ef1c528a9b91eec/a94544d/pdf/src/file.rs:640:9
  37: pdf_rs::check_file
             at ./src/crates/pdf_rs/src/main.rs:29:35
  38: pdf_rs::main
             at ./src/crates/pdf_rs/src/main.rs:21:9
  39: core::ops::function::FnOnce::call_once
             at /home/runner/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

##### Automatic Fuzzer note, output status "None", output signal "Some(6)"

compressed.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions