Fuzzing the Font Parser of Compound Documents

Currently, complex software (e.g. PDF readers) usually takes various inputs embedded with multiple objects (e.g. fonts, pictures), which may result in bugs. It is a challenge to generate suitable test cases to support fine-grained test to the PDF readers. Compared with the traditional blind fuzzing which does not utilize the information of input grammars, fuzzing with the model of the file format is an effective technique. In this paper, we leverage the structure information of the font files to select seed files among the heterogeneous fonts. A general construction method for generating suitable test cases is proposed. By this means, we can obtain test cases with low overhead. Moreover, to improve the expression ability of the font template in fuzzing PDF readers, we combine file reconstruction and template description. Our methods are evaluated on five common-used PDF readers, and proved effective in triggering crashes.