Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 01 Feb 2017 16:13:01 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Subject: podofo: NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp)

Description:
podofo is a C++ library to work with the PDF file format.

A fuzz on it discovered a NULL pointer access. The upstream project denies me 
to open a new ticket. So, I’m unable to communicate with them.

The complete ASan output:

# podofopdfinfo $FILE
==9418==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d8 (pc 
0x7f496cb0ab76 bp 0x7ffff028f9d0 sp 0x7ffff028f148 T0)                                                                                                                                             
==9418==The signal is caused by a WRITE memory access.                                                                                                                                                                                                                         
==9418==Hint: address points to the zero page.                                                                                                                                                                                                                                 
    #0 0x7f496cb0ab75  /var/tmp/portage/sys-libs/glibc-2.22-
r4/work/glibc-2.22/string/../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:1989                                                                                                                                     
    #1 0x4c063e in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.0-
r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413                                                                                                                               
    #2 0x7f496dde143c in void std::_Construct(PoDoFo::PdfParser::TXRefEntry*, 
PoDoFo::PdfParser::TXRefEntry const&) /usr/lib/gcc/x86_64-pc-linux-
gnu/4.9.3/include/g++-v4/bits/stl_construct.h:83:38             
    #3 0x7f496dde143c in void 
std::__uninitialized_fill_n::__uninit_fill_n(PoDoFo::PdfParser::TXRefEntry*, 
unsigned long, PoDoFo::PdfParser::TXRefEntry const&) /usr/lib/gcc/x86_64-pc-
linux-gnu/4.9.3/include/g++-v4/bits/stl_uninitialized.h:202                                                                                                                                                                                                                       
    #4 0x7f496dde143c in void 
std::uninitialized_fill_n(PoDoFo::PdfParser::TXRefEntry*, unsigned long, 
PoDoFo::PdfParser::TXRefEntry const&) /usr/lib/gcc/x86_64-pc-linux-
gnu/4.9.3/include/g++-v4/bits/stl_uninitialized.h:244                                                                                                                                                                                                                                                 
    #5 0x7f496dde143c in void 
std::__uninitialized_fill_n_a(PoDoFo::PdfParser::TXRefEntry*, unsigned long, 
PoDoFo::PdfParser::TXRefEntry const&, std::allocator&) /usr/lib/gcc/x86_64-pc-
linux-gnu/4.9.3/include/g++-v4/bits/stl_uninitialized.h:355                                                                                                                                                              
    #6 0x7f496dde143c in std::vector<PoDoFo::PdfParser::TXRefEntry, 
std::allocator 
>::_M_fill_insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, 
std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, 
PoDoFo::PdfParser::TXRefEntry const&) /usr/lib/gcc/x86_64-pc-linux-
gnu/4.9.3/include/g++-v4/bits/vector.tcc:496                                                                                                                                 
    #7 0x7f496ddd4a67 in std::vector<PoDoFo::PdfParser::TXRefEntry, 
std::allocator 
>::insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, 
std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, 
PoDoFo::PdfParser::TXRefEntry const&) /usr/lib/gcc/x86_64-pc-linux-
gnu/4.9.3/include/g++-v4/bits/stl_vector.h:1073:9                                                                                                                                    
    #8 0x7f496ddd4a67 in std::vector<PoDoFo::PdfParser::TXRefEntry, 
std::allocator >::resize(unsigned long, PoDoFo::PdfParser::TXRefEntry) 
/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.3/include/g++-v4/bits/stl_vector.h:716                          
    #9 0x7f496ddd4a67 in PoDoFo::PdfParser::ReadXRefSubsection(long&, long&) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfParser.cpp:772                                                                                                                   
    #10 0x7f496ddc60bd in PoDoFo::PdfParser::ReadXRefContents(long, bool) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfParser.cpp:725:17                                                                                                                   
    #11 0x7f496ddbfaae in PoDoFo::PdfParser::ReadDocumentStructure() 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfParser.cpp:337:9                                                                                                                         
    #12 0x7f496ddbce1f in 
PoDoFo::PdfParser::ParseFile(PoDoFo::PdfRefCountedInputDevice const&, bool) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfParser.cpp:220:9                                                                                        
    #13 0x7f496ddbb1e4 in PoDoFo::PdfParser::ParseFile(char const*, bool) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfParser.cpp:164:11                                                                                                                   
    #14 0x7f496e018393 in PoDoFo::PdfMemDocument::Load(char const*) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/doc/PdfMemDocument.cpp:186:16                                                                                                                     
    #15 0x7f496e018062 in PoDoFo::PdfMemDocument::PdfMemDocument(char const*) 
/tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/src/doc/PdfMemDocument.cpp:88:11                                                                                                            
    #16 0x511b44 in PdfInfo::PdfInfo(std::string const&) /tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/tools/podofopdfinfo/pdfinfo.cpp:25:16                                                                                                                            
    #17 0x521ac8 in main /tmp/portage/app-
text/podofo-0.9.4/work/podofo-0.9.4/tools/podofopdfinfo/podofopdfinfo.cpp:110:15                                                                                                                                                     
    #18 0x7f496c9f461f in __libc_start_main /var/tmp/portage/sys-
libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289                                                                                                                                                       
    #19 0x41e8f8 in _start (/usr/bin/podofopdfinfo+0x41e8f8)                                                                                                                                                                                                                   
                                                                                                                                                                                                                                                                               
AddressSanitizer can not provide additional info.                                                                                                                                                                                                                              
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/sys-libs/glibc-2.22-
r4/work/glibc-2.22/string/../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:1989                                                                                                                            
==9418==ABORTING

Affected version:
0.9.4

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00134-podofo-nullptr-pdfparser-cpp

Timeline:
2017-01-05: bug discovered
2017-02-01: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp

-- 
Agostino Sarubbo
Gentoo Linux Developer

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.