Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What work has been done on fuzzing of the PDF file format? I'm looking for work that focuses specifically on PDF, and is aware of the PDF file format. Has there been past work that builds format-aware tools for fuzzing PDF? Perhaps format-aware mutational fuzzing or generational fuzzing? And are any of the tools or test suites publicly available? The PDF file format is incredibly complex; I'd like to avoid re-inventing the wheel.

share|improve this question

2 Answers 2

There is work on the topic, at several levels.

  • fuzzing of the internal tables - very easy, and doesn't really work
  • fuzzing of internal codecs such as z-streams
  • fuzzing of internal formats, e.g. fonts, JPGs, TIFFs etc. - I'm aware of some buggy implementations of CCITT "fax" monochrome picture that are still used by some fax-to-PDF machines, i.e. the companion application uses a buggy libTIFF decoder; one of these turned out as BugTraq 46-658, but there are more)
  • fuzzing of "extensions" such as Javascript. One tool that does this is pdffuzzer.

You will probably be interested in reading about j00ru et al.'s work (updated). An effort in Python can be found here.

share|improve this answer

look at white-box fuzzer BUZZFUZZ technical report available at https://ece.uwaterloo.ca/~vganesh/buzzfuzz.html

share|improve this answer
    
Corrected link: ece.uwaterloo.ca/~vganesh/Publications_files/… - the one you gave does not contain the BuzzFuzz technical report. –  D.W. Sep 30 '13 at 17:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.