podofo is a C++ library to work with the PDF file format.
A fuzz on it with the UBSAN discovered a NULL pointer access. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them.
The complete UBSan output:
# podofopdfinfo $FILE /tmp/portage/app-text/podofo-0.9.4/work/podofo-0.9.4/src/base/PdfOutputStream.cpp:116:33: runtime error: null pointer passed as argument 2, which is declared to never be null
This bug was discovered by Agostino Sarubbo of Gentoo.
2017-01-05: bug discovered
2017-02-01: blog post about the issue
2017-02-02: CVE assigned
This bug was found with American Fuzzy Lop.