4

What work has been done on fuzzing of the PDF file format? I'm looking for work that focuses specifically on PDF, and is aware of the PDF file format. Has there been past work that builds format-aware tools for fuzzing PDF? Perhaps format-aware mutational fuzzing or generational fuzzing? And are any of the tools or test suites publicly available? The PDF file format is incredibly complex; I'd like to avoid re-inventing the wheel.

6

There is work on the topic, at several levels.

  • fuzzing of the internal tables - very easy, and doesn't really work
  • fuzzing of internal codecs such as z-streams
  • fuzzing of internal formats, e.g. fonts, JPGs, TIFFs etc. - I'm aware of some buggy implementations of CCITT "fax" monochrome picture that are still used by some fax-to-PDF machines, i.e. the companion application uses a buggy libTIFF decoder; one of these turned out as BugTraq 46-658, but there are more)
  • fuzzing of "extensions" such as Javascript. One tool that does this is pdffuzzer.

You will probably be interested in reading about j00ru et al.'s work (updated). An effort in Python can be found here.

1

look at white-box fuzzer BUZZFUZZ technical report available at https://ece.uwaterloo.ca/~vganesh/buzzfuzz.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.