{"id":1323,"date":"2017-03-02T18:24:27","date_gmt":"2017-03-02T16:24:27","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1323"},"modified":"2017-03-13T11:59:16","modified_gmt":"2017-03-13T09:59:16","slug":"podofo-global-buffer-overflow-in-podofopdfparserreadxrefsubsection-pdfparser-cpp","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/02\/podofo-global-buffer-overflow-in-podofopdfparserreadxrefsubsection-pdfparser-cpp\/","title":{"rendered":"podofo: global buffer overflow in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered a global overflow. The upstream project denies me to open a new ticket. So, I just will forward this on the -users mailing list.<\/p>\n

The complete ASan output:<\/p>\n

# podofocolor dummy $FILE foo\r\n==15599==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000014a5838 at pc 0x0000004ca58c bp 0x7ffebe3248b0 sp 0x7ffebe324060\r\nWRITE of size 24 at 0x0000014a5838 thread T0\r\n    #0 0x4ca58b in __asan_memcpy \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413\r\n    #1 0x7efe75862464 in void std::_Construct(PoDoFo::PdfParser::TXRefEntry*, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_construct.h:83:38\r\n    #2 0x7efe75862464 in void std::__uninitialized_fill_n::__uninit_fill_n(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:202\r\n    #3 0x7efe75862464 in void std::uninitialized_fill_n(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:244\r\n    #4 0x7efe75862464 in void std::__uninitialized_fill_n_a(PoDoFo::PdfParser::TXRefEntry*, unsigned long, PoDoFo::PdfParser::TXRefEntry const&, std::allocator&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_uninitialized.h:355\r\n    #5 0x7efe75862464 in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::_M_fill_insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/vector.tcc:496\r\n    #6 0x7efe75855a47 in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::insert(__gnu_cxx::__normal_iterator<PoDoFo::PdfParser::TXRefEntry*, std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator > >, unsigned long, PoDoFo::PdfParser::TXRefEntry const&) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_vector.h:1073:9\r\n    #7 0x7efe75855a47 in std::vector<PoDoFo::PdfParser::TXRefEntry, std::allocator >::resize(unsigned long, PoDoFo::PdfParser::TXRefEntry) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.3\/include\/g++-v4\/bits\/stl_vector.h:716\r\n    #8 0x7efe75855a47 in PoDoFo::PdfParser::ReadXRefSubsection(long&, long&) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:772\r\n    #9 0x7efe758470ad in PoDoFo::PdfParser::ReadXRefContents(long, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:725:17\r\n    #10 0x7efe75840a9e in PoDoFo::PdfParser::ReadDocumentStructure() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:337:9\r\n    #11 0x7efe7583de0f in PoDoFo::PdfParser::ParseFile(PoDoFo::PdfRefCountedInputDevice const&, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:220:9\r\n    #12 0x7efe7583c1d4 in PoDoFo::PdfParser::ParseFile(char const*, bool) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfParser.cpp:164:11\r\n    #13 0x7efe75a993f3 in PoDoFo::PdfMemDocument::Load(char const*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfMemDocument.cpp:186:16\r\n    #14 0x7efe75a990c2 in PoDoFo::PdfMemDocument::PdfMemDocument(char const*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfMemDocument.cpp:88:11\r\n    #15 0x51e96d in ColorChanger::start() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/colorchanger.cpp:110:20\r\n    #16 0x51c06d in main \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/podofocolor.cpp:116:12\r\n    #17 0x7efe7424861f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #18 0x428718 in _start (\/usr\/bin\/podofocolor+0x428718)\r\n\r\n0x0000014a5838 is located 0 bytes to the right of global variable 'PoDoFo::PODOFO_BUILTIN_FONTS' defined in '\/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfFontFactoryBase14Data.h:4460:33' (0x14a4aa0) of size 3480\r\nSUMMARY: AddressSanitizer: global-buffer-overflow \/tmp\/portage\/sys-devel\/llvm-3.9.0-r1\/work\/llvm-3.9.0.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413 in __asan_memcpy\r\nShadow bytes around the buggy address:\r\n  0x00008028cab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x00008028cac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x00008028cad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x00008028cae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x00008028caf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x00008028cb00: 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008028cb10: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008028cb20: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008028cb30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008028cb40: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n  0x00008028cb50: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Heap right redzone:      fb\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack partial redzone:   f4\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==15599==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.4<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-6844<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00171-podofo-globaloverflow-PoDoFo-PdfParser-ReadXRefSubsection<\/a><\/p>\n
Timeline:<\/strong>
\n2017-02-13: bug discovered
\n2017-03-02: bug reported to upstream
\n2017-03-02: blog post about the issue
\n2017-03-12: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
podofo: global buffer overflow in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp)<\/a><\/p><\/blockquote>\n