{"id":1329,"date":"2017-03-02T18:24:33","date_gmt":"2017-03-02T16:24:33","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1329"},"modified":"2017-03-13T12:02:02","modified_gmt":"2017-03-13T10:02:02","slug":"podofo-null-pointer-dereference-in-podofopdfvariantdelayedload-pdfvariant-h","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/02\/podofo-null-pointer-dereference-in-podofopdfvariantdelayedload-pdfvariant-h\/","title":{"rendered":"podofo: NULL pointer dereference in PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered a null pointer dereference. The upstream project denies me to open a new ticket. So, I just will forward this on the -users mailing list.<\/p>\n

The complete ASan output:<\/p>\n

# podofocolor dummy $FILE foo\r\n==5768==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x7f6504f1742c bp 0x7fffc41a0df0 sp 0x7fffc41a0d00 T0)\r\n==5768==The signal is caused by a READ memory access.\r\n==5768==Hint: address points to the zero page.\r\n    #0 0x7f6504f1742b in PoDoFo::PdfVariant::DelayedLoad() const \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfVariant.h:545:10\r\n    #1 0x7f6504f1742b in PoDoFo::PdfVariant::GetArray() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfVariant.h:795\r\n    #2 0x7f6504f1742b in PoDoFo::PdfXObject::PdfXObject(PoDoFo::PdfObject*) \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/doc\/PdfXObject.cpp:264\r\n    #3 0x51ff55 in ColorChanger::start() \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/colorchanger.cpp:137:28\r\n    #4 0x51c06d in main \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/tools\/podofocolor\/podofocolor.cpp:116:12\r\n    #5 0x7f650358c61f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289\r\n    #6 0x428718 in _start (\/usr\/bin\/podofocolor+0x428718)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/portage\/app-text\/podofo-0.9.4\/work\/podofo-0.9.4\/src\/base\/PdfVariant.h:545:10 in PoDoFo::PdfVariant::DelayedLoad() const\r\n==5768==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.4<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-6847<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00174-podofo-nullptr-PoDoFo-PdfVariant-DelayedLoad<\/a><\/p>\n
Timeline:<\/strong>
\n2017-02-13: bug discovered
\n2017-03-02: bug reported to upstream
\n2017-03-02: blog post about the issue
\n2017-03-12: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
podofo: NULL pointer dereference in PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h)<\/a><\/p><\/blockquote>\n