{"id":1396,"date":"2017-03-02T18:24:20","date_gmt":"2017-03-02T16:24:20","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1396"},"modified":"2017-03-13T11:57:30","modified_gmt":"2017-03-13T09:57:30","slug":"podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementtgraphicsstackelement-graphicsstack-h","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/02\/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementtgraphicsstackelement-graphicsstack-h\/","title":{"rendered":"podofo: NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h)"},"content":{"rendered":"

Description<\/strong>:
\npodofo<\/a> is a C++ library to work with the PDF file format.<\/p>\n

A fuzz on it discovered a null pointer dereference. The upstream project denies me to open a new ticket. So, I just will forward this on the -users mailing list.<\/p>\n

The complete ASan output:<\/p>\n

# podofocolor dummy $FILE foo\r\n==7677==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000054b701 bp 0x7ffe64ec7cb0 sp 0x7ffe64ec7c80 T0)\r\n==7677==The signal is caused by a READ memory access.\r\n==7677==Hint: address points to the zero page.\r\n    #0 0x54b700 in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement() \/tmp\/portage\/app-text\/podofo-0.9.5\/work\/podofo-0.9.5\/tools\/podofocolor\/graphicsstack.h:29:11\r\n    #1 0x55b772 in std::deque<GraphicsStack::TGraphicsStackElement, std::allocator >::pop_back() \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.4\/include\/g++-v4\/bits\/stl_deque.h:1459:4\r\n    #2 0x52c84d in ColorChanger::ReplaceColorsInPage(PoDoFo::PdfCanvas*) \/tmp\/portage\/app-text\/podofo-0.9.5\/work\/podofo-0.9.5\/tools\/podofocolor\/colorchanger.cpp:190:35\r\n    #3 0x526921 in ColorChanger::start() \/tmp\/portage\/app-text\/podofo-0.9.5\/work\/podofo-0.9.5\/tools\/podofocolor\/colorchanger.cpp:120:15\r\n    #4 0x523b8d in main \/tmp\/portage\/app-text\/podofo-0.9.5\/work\/podofo-0.9.5\/tools\/podofocolor\/podofocolor.cpp:116:12\r\n    #5 0x7fc9a444f78f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #6 0x4300e8 in _start (\/usr\/bin\/podofocolor+0x4300e8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/portage\/app-text\/podofo-0.9.5\/work\/podofo-0.9.5\/tools\/podofocolor\/graphicsstack.h:29:11 in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement()\r\n==7677==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.9.5<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-6841<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00216-podofo-nullptr-graphicsstack-h<\/a>                                                              <\/p>\n
Timeline:<\/strong>
\n2017-03-01: bug discovered
\n2017-03-02: bug reported to upstream
\n2017-03-02: blog post about the issue
\n2017-03-12: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
podofo: NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h)<\/a><\/p><\/blockquote>\n