{"id":1185,"date":"2017-02-01T17:03:25","date_gmt":"2017-02-01T15:03:25","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1185"},"modified":"2017-02-02T13:49:54","modified_gmt":"2017-02-02T11:49:54","slug":"podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/02\/01\/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp\/","title":{"rendered":"podofo: NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered a NULL pointer access. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them.<\/p>\n

The complete ASan output:<\/p>\n

# podofopdfinfo $FILE\r\n==9418==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000d8 (pc 0x7f496cb0ab76 bp 0x7ffff028f9d0 sp 0x7ffff028f148 T0)                                                                                                                                             \r\n==9418==The signal is caused by a WRITE memory access.                                                                                                                                                                                                                         \r\n==9418==Hint: address points to the zero page.                                                                                                                                                                                                                                 \r\n    #0 0x7f496cb0ab75  \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/string\/..\/sysdeps\/x86_64\/multiarch\/memcpy-ssse3-back.S:1989                                                                                                                                     \r\n    #1 0x4c063e in __asan_memcpy \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413                                                                                                                               \r\n    #2 0x7f496dde143c in void std::_Construct(PoDoFo::PdfParser::TXRefEntry*, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_construct.h:83:38             \r\n    #3 0x7f496dde143c in void std::__uninitialized_fill_n::__uninit_fill_n(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:202                                                                                                                                                                                                                       \r\n    #4 0x7f496dde143c in void std::uninitialized_fill_n(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:244                                                                                                                                                                                                                                                 \r\n    #5 0x7f496dde143c in void std::__uninitialized_fill_n_a(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&, std::allocator&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:355                                                                                                                                                              \r\n    #6 0x7f496dde143c in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::_M_fill_insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/vector.tcc:496                                                                                                                                 \r\n    #7 0x7f496ddd4a67 in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_vector.h:1073:9                                                                                                                                    \r\n    #8 0x7f496ddd4a67 in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::resize(unsigned long, PoDoFo::PdfParser::TXRefEntry) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_vector.h:716                          \r\n    #9 0x7f496ddd4a67 in PoDoFo::PdfParser::ReadXRefSubsection(long&, long&) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:772                                                                                                                   \r\n    #10 0x7f496ddc60bd in PoDoFo::PdfParser::ReadXRefContents(long, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:725:17                                                                                                                   \r\n    #11 0x7f496ddbfaae in PoDoFo::PdfParser::ReadDocumentStructure() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:337:9                                                                                                                         \r\n    #12 0x7f496ddbce1f in PoDoFo::PdfParser::ParseFile(PoDoFo::PdfRefCountedInputDevice const&, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:220:9                                                                                        \r\n    #13 0x7f496ddbb1e4 in PoDoFo::PdfParser::ParseFile(char const*, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:164:11                                                                                                                   \r\n    #14 0x7f496e018393 in PoDoFo::PdfMemDocument::Load(char const*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfMemDocument.cpp:186:16                                                                                                                     \r\n    #15 0x7f496e018062 in PoDoFo::PdfMemDocument::PdfMemDocument(char const*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfMemDocument.cpp:88:11                                                                                                            \r\n    #16 0x511b44 in PdfInfo::PdfInfo(std::string const&) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofopdfinfo\/pdfinfo.cpp:25:16                                                                                                                            \r\n    #17 0x521ac8 in main \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofopdfinfo\/podofopdfinfo.cpp:110:15                                                                                                                                                     \r\n    #18 0x7f496c9f461f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289                                                                                                                                                       \r\n    #19 0x41e8f8 in _start (\/usr\/bin\/podofopdfinfo+0x41e8f8)                                                                                                                                                                                                                   \r\n                                                                                                                                                                                                                                                                               \r\nAddressSanitizer can not provide additional info.                                                                                                                                                                                                                              \r\nSUMMARY: AddressSanitizer: SEGV \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/string\/..\/sysdeps\/x86_64\/multiarch\/memcpy-ssse3-back.S:1989                                                                                                                            \r\n==9418==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.4<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-5855<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00134-podofo-nullptr-pdfparser-cpp<\/a><\/p>\n
Timeline:<\/strong>
\n2017-01-05: bug discovered
\n2017-02-01: blog post about the issue
\n2017-02-02: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong>
\nhttps:\/\/blogs.gentoo.org\/ago\/2017\/02\/01\/podofo-null-pointer-dereference-in-podofopdfparserreadxrefsubsection-pdfparser-cpp<\/p>\n","protected":false},"excerpt":{"rendered":"
Description: podofo is a C++ library to work with the PDF file format. A fuzz on it discovered a NULL pointer access. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them. The … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-j7","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1185"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1185"}],"version-history":[{"count":7,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1185\/revisions"}],"predecessor-version":[{"id":1267,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1185\/revisions\/1267"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}