Bug 698888

Summary:	oss-fuzz 5503/5598: Assert triggered in copy_node_types()
Product:	MuPDF	Reporter:	Sebastian Rasmussen <sebastian.rasmussen>
Component:	mupdf	Assignee:	Sebastian Rasmussen <sebastian.rasmussen>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	P4
Version:	unspecified
Hardware:	PC
OS:	Linux
Customer:		Word Size:	---
Attachments:	Minimized PDF from oss-fuzz.

Description Sebastian Rasmussen 2018-01-22 06:47:36 UTC

Created attachment 14619 [details]
Minimized PDF from oss-fuzz.

Running

build/sanitize/mutool draw -s t ./oss-fuzz-5503.pdf 

causes

error: cannot recognize xref format
warning: trying to repair broken xref
warning: repairing PDF document
warning: object missing 'endobj' token
warning: ignoring invalid character in hex string
warning: ... repeated 3 times ...
warning: bf_range limits out of range in cmap pdfapi2-MyReCBH~1380294183+0
warning: ignoring invalid character in hex string
warning: ... repeated 56 times ...
warning: premature end of data in flate filter
warning: ignoring invalid character in hex string
warning: ... repeated 17 times ...
warning: lexical error (unexpected '>')
warning: ... repeated 2 times ...
warning: ignoring invalid character in hex string
warning: ... repeated 6 times ...
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: ... repeated 2 times ...
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: ... repeated 2 times ...
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: ... repeated 9 times ...
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: ... repeated 3 times ...
warning: lexical error (unexpected '>')
warning: ... repeated 4 times ...
warning: ignoring invalid character in hex string
warning: lexical error (unexpected '>')
warning: ignoring invalid character in hex string
warning: ... repeated 2 times ...
warning: lexical error (unexpected '>')
warning: ... repeated 2 times ...
warning: ignoring invalid character in hex string
warning: ... repeated 9 times ...
warning: premature end of data in flate filter
mutool: source/pdf/pdf-cmap.c:701: copy_node_types: Assertion `node->low == node->high' failed.
Aborted

Comment 1 Sebastian Rasmussen 2018-01-22 18:17:16 UTC

I have a tentative fix awaiting review in commit 05cb1243fab1ebd9771d1791f39706e2339abfa5 that appears to fix this issue.

Comment 2 Sebastian Rasmussen 2018-01-26 09:05:18 UTC

Fixed in 

commit 71ceebcf56e682504da22c4035b39a2d451e8ffd
Author: Sebastian Rasmussen <sebras@gmail.com>
Date:   Tue Jan 23 03:04:33 2018 +0100

    Bug 698888: Keep one-to-many state when splitting nodes in cmap splay trees.
    
    Thanks to oss-fuzz for reporting this.