{"id":1818,"date":"2017-05-21T11:25:14","date_gmt":"2017-05-21T09:25:14","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1818"},"modified":"2017-08-22T10:02:26","modified_gmt":"2017-08-22T08:02:26","slug":"qpdf-three-infinite-loop-in-libqpdf","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/05\/21\/qpdf-three-infinite-loop-in-libqpdf\/","title":{"rendered":"qpdf: three infinite loop in libqpdf"},"content":{"rendered":"

Description<\/strong>:
\nqpdf<\/a> QPDF is a command-line program that does structural, content-preserving transformations on PDF files.<\/p>\n

I discovered three infinite loop. Upstream didn’t provide a feedback, so they might have the same root cause.<\/p>\n

# qpdf $FILE -\r\n==8000==ERROR: AddressSanitizer: stack-overflow on address 0x7fff9cf4efd8 (pc 0x7f925abe7e23 bp 0x7fff9cf4f050 sp 0x7fff9cf4efe0 T0)\r\n    #0 0x7f925abe7e22 in QPDFObjectHandle::assertInitialized() const \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:1380\r\n    #1 0x7f925abe38aa in QPDFObjectHandle::isIndirect() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:241:5\r\n    #2 0x7f925abe38aa in QPDFObjectHandle::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:71\r\n    #3 0x7f925ad2ca5d in QPDFObjectHandle::ReleaseResolver::releaseResolved(QPDFObjectHandle&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDFObjectHandle.hh:554:8\r\n    #4 0x7f925ad2ca5d in QPDF_Array::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Array.cc:19\r\n    #5 0x7f925abe3c24 in QPDFObject::ObjAccessor::releaseResolved(QPDFObject*) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDFObject.hh:67:6\r\n    #6 0x7f925abe3c24 in QPDFObjectHandle::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:80\r\n    #7 0x7f925ad30a6e in QPDFObjectHandle::ReleaseResolver::releaseResolved(QPDFObjectHandle&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDFObjectHandle.hh:554:8\r\n    #8 0x7f925ad30a6e in QPDF_Dictionary::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Dictionary.cc:23\r\n    #9 0x7f925abe3c24 in QPDFObject::ObjAccessor::releaseResolved(QPDFObject*) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDFObject.hh:67:6\r\n    #10 0x7f925abe3c24 in QPDFObjectHandle::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:80\r\n    #11 0x7f925ad30a6e in QPDFObjectHandle::ReleaseResolver::releaseResolved(QPDFObjectHandle&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDFObjectHandle.hh:554:8\r\n    #12 0x7f925ad30a6e in QPDF_Dictionary::releaseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Dictionary.cc:23\r\n<\/font><\/pre>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00176-qpdf-infiniteloop1<\/a>
\nCVE:<\/strong>
\nCVE-2017-9208<\/p>\n
############################<\/p>\n
# qpdf $FILE -\r\n    #0 0x427108 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/tmp\/portage\/sys-devel\/llvm-3.9.1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:323\r\n    #1 0x50ce78 in operator new(unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_new_delete.cc:78\r\n    #2 0x7fe47c18de58 in std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator const&) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf3e58)\r\n    #3 0x7fe47c18ec3a in std::string::_Rep::_M_clone(std::allocator const&, unsigned long) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf4c3a)\r\n    #4 0x7fe47c18ece3 in std::string::reserve(unsigned long) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf4ce3)\r\n    #5 0x7fe47c656405 in std::string::push_back(char) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.4\/include\/g++-v4\/bits\/basic_string.h:1072:10\r\n    #6 0x7fe47c656405 in std::string::operator+=(char) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.4\/include\/g++-v4\/bits\/basic_string.h:968\r\n    #7 0x7fe47c656405 in QPDFTokenizer::presentCharacter(char) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFTokenizer.cc:189\r\n    #8 0x7fe47c65d19a in QPDFTokenizer::readToken(PointerHolder, std::string const&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFTokenizer.cc:519:6\r\n    #9 0x7fe47c61da83 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:873:23\r\n    #10 0x7fe47c61f018 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:939:15\r\n    #11 0x7fe47c6122d4 in QPDFObjectHandle::parse(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:841:12\r\n    #12 0x7fe47c553ec1 in QPDF::readObject(PointerHolder, std::string const&, int, int, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1017:31\r\n    #13 0x7fe47c542a0b in QPDF::reconstruct_xref(QPDFExc&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:393:7\r\n    #14 0x7fe47c57e826 in QPDF::readObjectAtOffset(bool, long long, std::string const&, int, int, int&, int&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1359:6\r\n    #15 0x7fe47c59e56d in QPDF::resolve(int, int) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1474:7\r\n    #16 0x7fe47c5f4854 in QPDF::Resolver::resolve(QPDF*, int, int) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDF.hh:520:19\r\n    #17 0x7fe47c5f4854 in QPDFObjectHandle::dereference() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:1520\r\n    #18 0x7fe47c626227 in QPDFObjectHandle::isName() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:184:5\r\n    #19 0x7fe47c626227 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:1074\r\n    #20 0x7fe47c61f018 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:939:15\r\n    #21 0x7fe47c6122d4 in QPDFObjectHandle::parse(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:841:12\r\n    #22 0x7fe47c553ec1 in QPDF::readObject(PointerHolder, std::string const&, int, int, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1017:31\r\n    #23 0x7fe47c542a0b in QPDF::reconstruct_xref(QPDFExc&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:393:7\r\n    #24 0x7fe47c57e826 in QPDF::readObjectAtOffset(bool, long long, std::string const&, int, int, int&, int&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1359:6\r\n    #25 0x7fe47c59e56d in QPDF::resolve(int, int) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF.cc:1474:7\r\n    #26 0x7fe47c5f4854 in QPDF::Resolver::resolve(QPDF*, int, int) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/include\/qpdf\/QPDF.hh:520:19\r\n    #27 0x7fe47c5f4854 in QPDFObjectHandle::dereference() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:1520\r\n    #28 0x7fe47c626227 in QPDFObjectHandle::isName() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:184:5\r\n    #29 0x7fe47c626227 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:1074\r\n    #30 0x7fe47c61f018 in QPDFObjectHandle::parseInternal(PointerHolder, std::string const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:939:15\r\n<\/font><\/pre>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00177-pdf-infiniteloop2<\/a>
\nCVE:<\/strong>
\nCVE-2017-9209<\/p>\n
############################<\/p>\n
# qpdf $FILE -\r\n==13070==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd0ba0efb0 (pc 0x00000042711b bp 0x7ffd0ba0f8a0 sp 0x7ffd0ba0efb0 T0)\r\n    #0 0x42711a in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/tmp\/portage\/sys-devel\/llvm-3.9.1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:325\r\n    #1 0x50ce78 in operator new(unsigned long) \/tmp\/portage\/sys-devel\/llvm-3.9.1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_new_delete.cc:78\r\n    #2 0x7f949448ae58 in std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator const&) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf3e58)\r\n    #3 0x7f949448bc3a in std::string::_Rep::_M_clone(std::allocator const&, unsigned long) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf4c3a)\r\n    #4 0x7f949448bce3 in std::string::reserve(unsigned long) (\/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/6.3.0\/libstdc++.so.6+0xf4ce3)\r\n    #5 0x7f9494a4451d in std::string::push_back(char) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.4\/include\/g++-v4\/bits\/basic_string.h:1072:10\r\n    #6 0x7f9494a4451d in std::string::operator+=(char) \/usr\/lib\/gcc\/x86_64-pc-linux-gnu\/4.9.4\/include\/g++-v4\/bits\/basic_string.h:968\r\n    #7 0x7f9494a4451d in QPDF_Name::normalizeName(std::string const&) \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Name.cc:24\r\n    #8 0x7f9494a3ddaa in QPDF_Dictionary::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Dictionary.cc:35:12\r\n    #9 0x7f949490c23f in QPDFObjectHandle::unparseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:699:23\r\n    #10 0x7f9494909e8c in QPDFObjectHandle::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:685:11\r\n    #11 0x7f9494a39cb0 in QPDF_Array::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Array.cc:30:20\r\n    #12 0x7f949490c23f in QPDFObjectHandle::unparseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:699:23\r\n    #13 0x7f9494909e8c in QPDFObjectHandle::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:685:11\r\n    #14 0x7f9494a3de56 in QPDF_Dictionary::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Dictionary.cc:36:27\r\n    #15 0x7f949490c23f in QPDFObjectHandle::unparseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:699:23\r\n    #16 0x7f9494909e8c in QPDFObjectHandle::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:685:11\r\n    #17 0x7f9494a39cb0 in QPDF_Array::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Array.cc:30:20\r\n    #18 0x7f949490c23f in QPDFObjectHandle::unparseResolved() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:699:23\r\n    #19 0x7f9494909e8c in QPDFObjectHandle::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDFObjectHandle.cc:685:11\r\n    #20 0x7f9494a3de56 in QPDF_Dictionary::unparse() \/tmp\/portage\/app-text\/qpdf-6.0.0-r1\/work\/qpdf-6.0.0\/libqpdf\/QPDF_Dictionary.cc:36:27\r\n<\/font><\/pre>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00177-qpdf-infiniteloop3<\/a>
\nCVE:<\/strong>
\nCVE-2017-9210<\/p>\n
############################<\/p>\n
Affected version:<\/strong>
\n6.0.0<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/github.com\/qpdf\/qpdf\/commit\/afe0242b263a9e1a8d51dd81e42ab6de2e5127eb<\/a>
\nhttps:\/\/github.com\/qpdf\/qpdf\/commit\/603f222365252f1a1e20303b3dbe52466be3053b<\/a>
\nhttps:\/\/github.com\/qpdf\/qpdf\/commit\/315092dd98d5230ef0efa18b294d464d0e9f79d0<\/a><\/p>\n
Credit:<\/strong>
\nThese bugs were discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2017-02-13: bug discovered and reported to upstream
\n2017-05-21: blog post about the issue
\n2017-05-23: CVE assigned
\n2017-07-26: upstream released a fix<\/p>\n
Note:<\/strong>
\nThese bugs were found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
qpdf: three infinite loop in libqpdf<\/a><\/p><\/blockquote>\n