Fix panics found with fuzzing

CHANGELOG.md

@@ -8,6 +8,11 @@
 - **[Feature]** Add experimental streaming parser.
 - **[Fix]** Remove `nom` macros.
 - **[Fix]** Add `clippy` support.
+- **[Fix]** Propagate string encoding errors.
+- **[Fix]** Fix panic on invalid image type.
+- **[Fix]** Fix panic on incomplete `DefineBitsLossless`.
+- **[Fix]** Fix panic on unknown audio codec code.
+- **[Fix]** Fix panic on invalid CSM text settings.
 
 ## Typescript
 

rs/Cargo.toml

@@ -29,16 +29,16 @@ nom = "^5.0.0"
 num-traits = "^0.2.8"
 regex = "^1.1.8"
 serde_json = "^1.0.40"
-swf-tree = "^0.9.0"
+swf-tree = { git="https://github.com/open-flash/swf-tree.git", rev = "524f19adc098d83900e94bbe693887a63b50786d" }
 swf-fixed = "^0.1.4"
 
 [dev-dependencies]
 serde = "^1.0.94"
 serde_json_v8 = "^0.0.1"
 test-generator = "^0.2.2"
 
-[replace]
-"swf-tree:0.9.0" = { git="https://github.com/open-flash/swf-tree.git", rev = "524f19adc098d83900e94bbe693887a63b50786d" }
+# [replace]
+# "swf-tree:0.9.0" = { git="https://github.com/open-flash/swf-tree.git", rev = "524f19adc098d83900e94bbe693887a63b50786d" }
 
 # When testing larger files, increasing `opt-level` provides a significant speed-up.
 # [profile.test]

rs/README.md

@@ -39,6 +39,8 @@ git submodule update --init --recursive --remote
 This library is a standard Cargo project. You can test your changes with
 `cargo test`. **The commands must be run from the `rs` directory.**
 
+## Fuzzing
+
 The Rust implementation supports fuzzing:
 
 ```

rs/fuzz/Cargo.toml

@@ -3,14 +3,14 @@ name = "swf-parser-fuzz"
 version = "0.0.1"
 authors = ["Automatically generated"]
 publish = false
+edition = "2018"
 
 [package.metadata]
 cargo-fuzz = true
 
-[dependencies.swf-parser]
-path = ".."
-[dependencies.libfuzzer-sys]
-git = "https://github.com/rust-fuzz/libfuzzer-sys.git"
+[dependencies]
+swf-parser = {path = ".."}
+libfuzzer-sys = "^0.1.1"
 
 # Prevent this from interfering with workspaces
 [workspace]
@@ -19,3 +19,7 @@ members = ["."]
 [[bin]]
 name = "swf"
 path = "fuzz_targets/swf.rs"
+
+[[bin]]
+name = "tag"
+path = "fuzz_targets/tag.rs"

rs/fuzz/fuzz_targets/swf.rs

@@ -1,6 +1,6 @@
 #![no_main]
-#[macro_use] extern crate libfuzzer_sys;
-extern crate swf_parser;
+
+use libfuzzer_sys::fuzz_target;
 
 fuzz_target!(|data: &[u8]| {
  let _ = swf_parser::complete::parse_swf(data);

rs/fuzz/fuzz_targets/tag.rs

@@ -0,0 +1,9 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+ if let Some((swf_version, data)) = data.split_first() {
+ let _ = swf_parser::complete::parse_tag(data, *swf_version);
+ }
+});

rs/src/complete/base.rs

@@ -0,0 +1,12 @@
+use nom::IResult as NomResult;
+
+/// Creates a parser skipping `count` bytes.
+pub(crate) fn skip<C, I, E: nom::error::ParseError<I>>(count: C) -> impl Fn(I) -> NomResult<I, (), E>
+where
+ I: nom::InputIter + nom::InputTake,
+ C: nom::ToUsize,
+{
+ use nom::bytes::complete::take;
+ use nom::combinator::map;
+ map(take(count), |_| ())
+}

rs/src/parsers/button.rs → rs/src/complete/button.rs

@@ -1,7 +1,7 @@
-use crate::parsers::basic_data_types::{parse_color_transform_with_alpha, parse_matrix};
-use crate::parsers::display::{parse_blend_mode, parse_filter_list};
-use crate::parsers::sound::parse_sound_info;
-use nom::number::streaming::{le_u16 as parse_le_u16, le_u8 as parse_u8};
+use crate::complete::display::{parse_blend_mode, parse_filter_list};
+use crate::complete::sound::parse_sound_info;
+use crate::streaming::basic_data_types::{parse_color_transform_with_alpha, parse_matrix};
+use nom::number::complete::{le_u16 as parse_le_u16, le_u8 as parse_u8};
 use nom::IResult as NomResult;
 use swf_tree as ast;
 

rs/src/parsers/display.rs → rs/src/complete/display.rs

@@ -1,5 +1,5 @@
-use crate::parsers::basic_data_types::{parse_le_fixed16_p16, parse_le_fixed8_p8, parse_straight_s_rgba8};
-use nom::number::streaming::{
+use crate::streaming::basic_data_types::{parse_le_fixed16_p16, parse_le_fixed8_p8, parse_straight_s_rgba8};
+use nom::number::complete::{
  le_f32 as parse_le_f32, le_u16 as parse_le_u16, le_u32 as parse_le_u32, le_u8 as parse_u8,
 };
 use nom::IResult as NomResult;

rs/src/parsers/gradient.rs → rs/src/complete/gradient.rs

@@ -1,5 +1,5 @@
-use crate::parsers::basic_data_types::{parse_s_rgb8, parse_straight_s_rgba8};
-use nom::number::streaming::le_u8 as parse_u8;
+use crate::streaming::basic_data_types::{parse_s_rgb8, parse_straight_s_rgba8};
+use nom::number::complete::le_u8 as parse_u8;
 use nom::IResult as NomResult;
 use swf_tree as ast;
 

rs/src/parsers/image.rs → rs/src/complete/image.rs

@@ -1,4 +1,4 @@
-use nom::number::streaming::{be_u16 as parse_be_u16, be_u32 as parse_be_u32, le_u32 as parse_le_u32};
+use nom::number::complete::{be_u16 as parse_be_u16, be_u32 as parse_be_u32, le_u32 as parse_le_u32};
 
 pub struct ImageDimensions {
  pub width: usize,
@@ -115,5 +115,5 @@ pub fn get_gif_image_dimensions(input: &[u8]) -> Result<ImageDimensions, ()> {
 }
 
 pub fn test_image_start(image_data: &[u8], start_bytes: &[u8]) -> bool {
- image_data[..start_bytes.len()] == *start_bytes
+ image_data.len() >= start_bytes.len() && image_data[..start_bytes.len()] == *start_bytes
 }

rs/src/complete/mod.rs

@@ -0,0 +1,16 @@
+pub(crate) mod base;
+pub(crate) mod button;
+pub(crate) mod display;
+pub(crate) mod gradient;
+pub(crate) mod image;
+pub(crate) mod morph_shape;
+pub(crate) mod movie;
+pub(crate) mod shape;
+pub(crate) mod sound;
+pub(crate) mod tag;
+pub(crate) mod text;
+pub(crate) mod video;
+
+pub use movie::parse_swf;
+pub use movie::SwfParseError;
+pub use tag::parse_tag;

rs/src/parsers/morph_shape.rs → rs/src/complete/morph_shape.rs

@@ -1,10 +1,10 @@
-use crate::parsers::basic_data_types::{
+use crate::complete::gradient::parse_morph_gradient;
+use crate::complete::shape::{parse_curved_edge_bits, parse_list_length, parse_straight_edge_bits, StyleBits};
+use crate::streaming::basic_data_types::{
  do_parse_u16_bits, do_parse_u32_bits, parse_bool_bits, parse_i32_bits, parse_le_fixed8_p8, parse_matrix,
  parse_straight_s_rgba8, parse_u16_bits,
 };
-use crate::parsers::gradient::parse_morph_gradient;
-use crate::parsers::shape::{parse_curved_edge_bits, parse_list_length, parse_straight_edge_bits, StyleBits};
-use nom::number::streaming::{le_u16 as parse_le_u16, le_u8 as parse_u8};
+use nom::number::complete::{le_u16 as parse_le_u16, le_u8 as parse_u8};
 use nom::{IResult as NomResult, Needed};
 use std::convert::TryFrom;
 use swf_tree as ast;

rs/src/parsers/shape.rs → rs/src/complete/shape.rs

@@ -1,13 +1,12 @@
-use nom::number::streaming::{le_u16 as parse_le_u16, le_u8 as parse_u8};
-use nom::{IResult as NomResult, Needed};
-use std::convert::TryFrom;
-use swf_tree as ast;
-
-use crate::parsers::basic_data_types::{
+use crate::complete::gradient::parse_gradient;
+use crate::streaming::basic_data_types::{
  do_parse_i32_bits, do_parse_u16_bits, do_parse_u32_bits, parse_bool_bits, parse_i32_bits, parse_le_fixed8_p8,
  parse_matrix, parse_s_rgb8, parse_straight_s_rgba8, parse_u16_bits,
 };
-use crate::parsers::gradient::parse_gradient;
+use nom::number::complete::{le_u16 as parse_le_u16, le_u8 as parse_u8};
+use nom::{IResult as NomResult, Needed};
+use std::convert::TryFrom;
+use swf_tree as ast;
 
 #[derive(PartialEq, Eq, Clone, Copy, Ord, PartialOrd)]
 pub enum ShapeVersion {

rs/src/parsers/sound.rs → rs/src/complete/sound.rs

@@ -1,28 +1,28 @@
-use nom::number::streaming::{le_u16 as parse_le_u16, le_u32 as parse_le_u32, le_u8 as parse_u8};
+use nom::number::complete::{le_u16 as parse_le_u16, le_u32 as parse_le_u32, le_u8 as parse_u8};
 use nom::IResult as NomResult;
 use swf_tree as ast;
 
-pub fn sound_rate_from_id(sound_rate_id: u8) -> ast::SoundRate {
- match sound_rate_id {
- 0 => ast::SoundRate::SoundRate5500,
- 1 => ast::SoundRate::SoundRate11000,
- 2 => ast::SoundRate::SoundRate22000,
- 3 => ast::SoundRate::SoundRate44000,
- _ => panic!("Unexpected sound rate id"),
+pub fn sound_rate_from_code(sound_rate_code: u8) -> Result<ast::SoundRate, ()> {
+ match sound_rate_code {
+ 0 => Ok(ast::SoundRate::SoundRate5500),
+ 1 => Ok(ast::SoundRate::SoundRate11000),
+ 2 => Ok(ast::SoundRate::SoundRate22000),
+ 3 => Ok(ast::SoundRate::SoundRate44000),
+ _ => Err(()),
  }
 }
 
-pub fn audio_coding_format_from_id(audio_coding_format_id: u8) -> ast::AudioCodingFormat {
- match audio_coding_format_id {
- 0 => ast::AudioCodingFormat::UncompressedNativeEndian,
- 1 => ast::AudioCodingFormat::Adpcm,
- 2 => ast::AudioCodingFormat::Mp3,
- 3 => ast::AudioCodingFormat::UncompressedLittleEndian,
- 4 => ast::AudioCodingFormat::Nellymoser16,
- 5 => ast::AudioCodingFormat::Nellymoser8,
- 6 => ast::AudioCodingFormat::Nellymoser,
- 11 => ast::AudioCodingFormat::Speex,
- _ => panic!("Unexpected audio coding format id"),
+pub fn audio_coding_format_from_code(audio_codec_code: u8) -> Result<ast::AudioCodingFormat, ()> {
+ match audio_codec_code {
+ 0 => Ok(ast::AudioCodingFormat::UncompressedNativeEndian),
+ 1 => Ok(ast::AudioCodingFormat::Adpcm),
+ 2 => Ok(ast::AudioCodingFormat::Mp3),
+ 3 => Ok(ast::AudioCodingFormat::UncompressedLittleEndian),
+ 4 => Ok(ast::AudioCodingFormat::Nellymoser16),
+ 5 => Ok(ast::AudioCodingFormat::Nellymoser8),
+ 6 => Ok(ast::AudioCodingFormat::Nellymoser),
+ 11 => Ok(ast::AudioCodingFormat::Speex),
+ _ => Err(()),
  }
 }