{"id":1327,"date":"2017-03-02T18:24:31","date_gmt":"2017-03-02T16:24:31","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1327"},"modified":"2017-03-13T12:10:47","modified_gmt":"2017-03-13T10:10:47","slug":"podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementsetnonstrokingcolorspace-graphicsstack-h","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/02\/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementsetnonstrokingcolorspace-graphicsstack-h\/","title":{"rendered":"podofo: NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered a null pointer dereference. The upstream project denies me to open a new ticket. So, I just will forward this on the -users mailing list.<\/p>\n

The complete ASan output:<\/p>\n

# podofocolor dummy $FILE foo\r\n==32192==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000525f24 bp 0x7ffe0a1fdc90 sp 0x7ffe0a1fdc00 T0)\r\n==32192==The signal is caused by a READ memory access.\r\n==32192==Hint: address points to the zero page.\r\n    #0 0x525f23 in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace(PoDoFo::EPdfColorSpace) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/graphicsstack.h:83:38\r\n    #1 0x525f23 in GraphicsStack::SetNonStrokingColorSpace(PoDoFo::EPdfColorSpace) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/graphicsstack.h:129\r\n    #2 0x525f23 in ColorChanger::ProcessColor(ColorChanger::EKeywordType, int, std::vector<PoDoFo::PdfVariant, std::allocator >&, GraphicsStack&) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/colorchanger.cpp:478\r\n    #3 0x521b3c in ColorChanger::ReplaceColorsInPage(PoDoFo::PdfCanvas*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/colorchanger.cpp:214:31\r\n    #4 0x51ed8e in ColorChanger::start() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/colorchanger.cpp:120:15\r\n    #5 0x51c06d in main \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/podofocolor.cpp:116:12\r\n    #6 0x7fc21680761f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #7 0x428718 in _start (\/usr\/bin\/podofocolor+0x428718)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/graphicsstack.h:83:38 in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace(PoDoFo::EPdfColorSpace)\r\n==32192==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.4<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-6846<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00173-podofo-nullptr-GraphicsStack-TGraphicsStackElement-SetNonStrokingColorSpace<\/a><\/p>\n
Timeline:<\/strong>
\n2017-02-13: bug discovered
\n2017-03-02: bug reported to upstream
\n2017-03-02: blog post about the issue
\n2017-03-12: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
podofo: NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h)<\/a><\/p><\/blockquote>\n