Fuzzed test data causes hang in the library

ironfede / openmcdf

Microsoft Compound File .net component - pure C# - netstandard 2.0

Mozilla Public License 2.0

297 stars 73 forks source link

Fuzzed test data causes hang in the library #50

Closed AmeetShinde closed 4 years ago

AmeetShinde commented 5 years ago

We were testing the library from security perspective using fuzzed data, and in some cases the library hangs if we modify header structures. Please find attached the culprit file

64-67(numberOfMiniFATSectors).docx

Is there any way to validate header structures for valid values?

ironfede commented 4 years ago

Thank you @AmeetShinde for your report. Your attached file seems not to be a valid compound file and this is correctly recognized by OpenMcdf -> CFFileFormatException("Invalid OLE structured storage file"); Do you have another file to test for? I'm closing this issue: if you think this is wrong, please open a new issue with anoter fuzzed file, valid from a specifications point of view. Many thanks, Federico