[testsuite] Add reproducers for CVE-2017-17724 & #209, #211

tests/bugfixes/github/test_CVE_2017_17724.py

@@ -0,0 +1,25 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class TestFuzzedPoC(metaclass=system_tests.CaseMeta):
+
+    url = [
+        "https://github.com/Exiv2/exiv2/issues/210",
+        "https://github.com/Exiv2/exiv2/issues/209"
+    ]
+
+    filename = system_tests.path("$data_path/2018-01-09-exiv2-crash-002.tiff")
+    commands = [
+        "$exiv2 -pR $filename",
+        "$exiv2 -pS $filename",
+        "$exiv2 $filename"
+    ]
+    retval = [1, 1, 0]
+
+    compare_stderr = system_tests.check_no_ASAN_UBSAN_errors
+
+    def compare_stdout(self, i, command, got_stdout, expected_stdout):
+        """ We don't care about the stdout, just don't crash """
+        pass

tests/bugfixes/github/test_issue_211.py

@@ -0,0 +1,22 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class TestFuzzedPoC(metaclass=system_tests.CaseMeta):
+
+    url = "https://github.com/Exiv2/exiv2/issues/211"
+
+    filename = system_tests.path("$data_path/2018-01-09-exiv2-crash-003.tiff")
+    commands = [
+        "$exiv2 -pR $filename",
+        "$exiv2 -pS $filename",
+        "$exiv2 $filename"
+    ]
+    retval = [1, 1, 0]
+
+    compare_stderr = system_tests.check_no_ASAN_UBSAN_errors
+
+    def compare_stdout(self, i, command, got_stdout, expected_stdout):
+        """ We don't care about the stdout, just don't crash """
+        pass