lopdf Findings from fuzzing

Findings from fuzzing

Open stusmall opened this issue 4 years ago • 2 comments

I recently started fuzzing this crate and have found a few crashes. First two issues I've found is a stack overflow and a panic from subtraction overflow, examples are attached.. As I continue to find new issues I'll add them as comments on this issue. stackoverflow.pdf subtractoverflow.pdf

The test I'm using to open these files and cause the crash is simply:


use lopdf::Document;

#[test]
fn f1(){
       let _ = Document::load("stackoverflow.pdf");
}

Oct 12 '19 19:10 stusmall

I recently started fuzzing this crate and have found a few crashes.

@stusmall, wouldn't it be nice to have the fuzzing test code added to the repository?

Mar 10 '20 15:03 svenfoo

Here's (part of) a stack trace from the stack overflow that occurs when attempting to read stackoverflow.pdf:

#11287 0x000055555565aea7 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11288 0x00005555555f2c94 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11289 0x000055555565a2c8 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11290 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8012ea0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11291 0x000055555565d6e9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11292 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7ffff7636eb0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11293 0x0000555555674395 in pom::parser::call::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:442
#11294 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8012630, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11295 0x0000555555677cc3 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11296 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8012658, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11297 0x000055555566d335 in pom::parser::Parser<I,O>::repeat::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:156
#11298 0x000055555567bbdf in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8012670, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11299 0x00005555556636d0 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14241) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11300 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80126a0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036

#11301 0x000055555565aea7 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11302 0x00005555555f2c94 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11303 0x000055555565a2c8 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11304 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80126e0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11305 0x000055555565d6e9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11306 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7ffff7637890, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11307 0x0000555555674395 in pom::parser::call::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:442
#11308 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8011e70, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11309 0x0000555555677cc3 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11310 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8011e98, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11311 0x000055555566d335 in pom::parser::Parser<I,O>::repeat::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:156
#11312 0x000055555567bbdf in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8011eb0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11313 0x00005555556636d0 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14240) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11314 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8011ee0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036

#11315 0x000055555565aea7 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11316 0x00005555555f2c94 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11317 0x000055555565a2c8 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11318 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8011f20, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11319 0x000055555565d6e9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11320 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7ffff7638270, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11321 0x0000555555674395 in pom::parser::call::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:442
#11322 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe800b280, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11323 0x0000555555677cc3 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11324 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8009d68, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11325 0x000055555566d335 in pom::parser::Parser<I,O>::repeat::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:156
#11326 0x000055555567bbdf in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8009db0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11327 0x00005555556636d0 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14239) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11328 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80112c0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036

#11329 0x000055555565aea7 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11330 0x00005555555f2c94 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11331 0x000055555565a2c8 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14238) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11332 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010b90, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11333 0x000055555565d6e9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14238) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11334 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010c10, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11335 0x0000555555677cc3 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14238) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11336 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe800d498, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11337 0x000055555566d335 in pom::parser::Parser<I,O>::repeat::{{closure}} (input=..., start=14238) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:156
#11338 0x000055555567bbdf in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe800d4b0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11339 0x0000555555663010 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14238) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11340 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010c80, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036

#11341 0x000055555565aea7 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11342 0x00005555555f2c94 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11343 0x000055555565a2c8 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11344 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010ce0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11345 0x000055555565d6e9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11346 0x000055555567b95f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010fd0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11347 0x00005555556630d0 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11348 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8010d60, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11349 0x0000555555677917 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11350 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe800d590, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11351 0x00005555556777be in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:517
#11352 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8009d80, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11353 0x00005555556777be in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:517
#11354 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80082a0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11355 0x00005555556777be in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:517
#11356 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8001c50, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11357 0x000055555565dff6 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11358 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7ffff763a3b0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11359 0x00005555556742d5 in pom::parser::call::{{closure}} (input=..., start=14237) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:442
#11360 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80031f0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11361 0x0000555555658b2a in <pom::parser::Parser<I,O> as core::ops::arith::Add<pom::parser::Parser<I,U>>>::add::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:470
#11362 0x00005555555ef737 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11363 0x0000555555657fb8 in <pom::parser::Parser<I,O> as core::ops::arith::Add<pom::parser::Parser<I,U>>>::add::{{closure}} (input=..., start=14231) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:469
#11364 0x000055555567c25f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8003848, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11365 0x000055555566c029 in pom::parser::Parser<I,O>::repeat::{{closure}} (input=..., start=14117) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:156
#11366 0x000055555567b5df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8003820, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036

#11367 0x000055555565b314 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:495
#11368 0x00005555555f2221 in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11369 0x000055555565a398 in <pom::parser::Parser<I,O> as core::ops::arith::Mul<pom::parser::Parser<I,U>>>::mul::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:494
#11370 0x000055555567b5df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80026c0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11371 0x000055555565daf9 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11372 0x000055555567b5df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8002bb0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11373 0x0000555555662e90 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11374 0x000055555567c15f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80032f0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11375 0x000055555565d145 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11376 0x000055555567c15f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8002e50, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11377 0x000055555565d3b5 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11378 0x000055555567c15f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8002e20, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11379 0x000055555565cb95 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11380 0x000055555567c15f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8002920, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11381 0x0000555555677f25 in <pom::parser::Parser<I,O> as core::ops::bit::Shr<F>>::shr::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:506
#11382 0x000055555567c35f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8002aa0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11383 0x0000555555663cd6 in pom::parser::Parser<I,O>::map::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:45
#11384 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8003c10, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11385 0x0000555555677917 in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:521
#11386 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8001b60, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11387 0x00005555556777be in <pom::parser::Parser<I,O> as core::ops::bit::BitOr>::bitor::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:517
#11388 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8009ae0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11389 0x000055555565dff6 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14110) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11390 0x000055555567c45f in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8009940, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11391 0x0000555555658d8c in <pom::parser::Parser<I,O> as core::ops::arith::Add<pom::parser::Parser<I,U>>>::add::{{closure}}::{{closure}} () at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:470
#11392 0x00005555555f035b in core::result::Result<T,E>::and_then (self=..., op=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/libcore/result.rs:714
#11393 0x0000555555658498 in <pom::parser::Parser<I,O> as core::ops::arith::Add<pom::parser::Parser<I,U>>>::add::{{closure}} (input=..., start=14101) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:469
#11394 0x000055555567b7df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe8008160, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11395 0x000055555565e0d5 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14101) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11396 0x000055555567b7df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe800a9b0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11397 0x000055555565d895 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14101) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11398 0x000055555567b7df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7fffe80063f0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11399 0x000055555565e0d5 in <pom::parser::Parser<I,O> as core::ops::arith::Sub<pom::parser::Parser<I,U>>>::sub::{{closure}} (input=..., start=14101) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:482
#11400 0x000055555567b7df in <alloc::boxed::Box<F> as core::ops::function::Fn<A>>::call (self=0x7ffff763c5c0, args=...) at /rustc/5e1a799842ba6ed4a57e91f7ab9435947482f7d8/src/liballoc/boxed.rs:1036
#11401 0x0000555555673933 in pom::parser::Parser<I,O>::parse_at (self=0x7ffff763c5c0, input=..., start=14101) at /home/neo/.cargo/registry/src/github.com-1ecc6299db9ec823/pom-3.1.0/src/parser.rs:33
#11402 0x000055555563c279 in lopdf::parser::indirect_object (input=..., offset=14101, expected_id=..., reader=0x7ffff6e3ec18) at src/parser.rs:164
#11403 0x0000555555583a4e in lopdf::reader::Reader::read_object (self=0x7ffff6e3ec18, offset=14101, expected_id=...) at src/reader.rs:203
#11404 0x00005555556793e7 in lopdf::reader::Reader::read::{{closure}} () at src/reader.rs:120

Mar 10 '20 15:03 svenfoo

lopdf lopdf copied to clipboard

Findings from fuzzing

lopdf
lopdf copied to clipboard