{"id":1218,"date":"2017-02-01T17:03:31","date_gmt":"2017-02-01T15:03:31","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1218"},"modified":"2017-02-02T13:47:58","modified_gmt":"2017-02-02T11:47:58","slug":"podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/02\/01\/podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp\/","title":{"rendered":"podofo: infinite loop in PoDoFo::PdfPage::GetInheritedKeyFromObject (PdfPage.cpp)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered an infinite loop. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them.<\/p>\n

The complete ASan output:<\/p>\n

# podofopdfinfo $FILE\r\n==8407==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcff058fe0 (pc 0x000000425a5f bp 0x6400000003f0 sp 0x7ffcff058fe0 T0)\r\n    #0 0x425a5e in GenericScopedLock \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_mutex.h:179\r\n    #1 0x425a5e in __sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>::PopulateFreeList(__sanitizer::AllocatorStats*, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >*, unsigned long, __sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>::RegionInfo*) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:540\r\n    #2 0x426297 in __sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>::AllocateBatch(__sanitizer::AllocatorStats*, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >*, unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:359\r\n    #3 0x4262f6 in __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >::Refill(__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>*, unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:1003\r\n    #4 0x4298ed in __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >::Allocate(__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>*, unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:952\r\n    #5 0x4298ed in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >, __sanitizer::LargeMmapAllocator >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >*, unsigned long, unsigned long, bool, bool) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:1324\r\n    #6 0x4298ed in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:368\r\n    #7 0x50e8b8 in operator new(unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_new_delete.cc:78\r\n    #8 0x7f2e77512621 in PoDoFo::PdfVariant::PdfVariant(PoDoFo::PdfDictionary const&) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfVariant.cpp:151:20\r\n    #9 0x7f2e77495f6d in PoDoFo::PdfObject::PdfObject(PoDoFo::PdfReference const&, char const*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfObject.cpp:62:7\r\n    #10 0x7f2e7751dcf8 in PoDoFo::PdfVecObjects::GetObject(PoDoFo::PdfReference const&) const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfVecObjects.cpp:151:15\r\n    #11 0x7f2e7749afe1 in PoDoFo::PdfObject::GetIndirectKey(PoDoFo::PdfName const&) const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfObject.cpp:237:30\r\n    #12 0x7f2e77741533 in PoDoFo::PdfPage::GetInheritedKeyFromObject(char const*, PoDoFo::PdfObject const*) const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfPage.cpp:230:26\r\n    #13 0x7f2e777415a4 in PoDoFo::PdfPage::GetInheritedKeyFromObject(char const*, PoDoFo::PdfObject const*) const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfPage.cpp:232:20\r\n    [.....]\r\n    #254 0x7f2e777415a4 in PoDoFo::PdfPage::GetInheritedKeyFromObject(char const*, PoDoFo::PdfObject const*) const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfPage.cpp:232:20\r\n\r\nSUMMARY: AddressSanitizer: stack-overflow \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_mutex.h:179 in GenericScopedLock\r\n==8407==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.4<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-5852<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00145-podofo-infiniteloop-PdfPage<\/a><\/p>\n
Timeline:<\/strong>
\n2017-01-05: bug discovered
\n2017-02-01: blog post about the issue
\n2017-02-02: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong>
\nhttps:\/\/blogs.gentoo.org\/ago\/2017\/02\/01\/podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp<\/p>\n","protected":false},"excerpt":{"rendered":"
Description: podofo is a C++ library to work with the PDF file format. A fuzz on it discovered an infinite loop. The upstream project denies me to open a new ticket. So, I’m unable to communicate with them. The complete … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[12,10],"tags":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2EaBc-jE","_links":{"self":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1218"}],"collection":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/comments?post=1218"}],"version-history":[{"count":6,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1218\/revisions"}],"predecessor-version":[{"id":1264,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/posts\/1218\/revisions\/1264"}],"wp:attachment":[{"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/media?parent=1218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/categories?post=1218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.gentoo.org\/ago\/wp-json\/wp\/v2\/tags?post=1218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}