Attachment 146598 Details for Bug 224448 – patch for CVE-2007-0104 as applied to poppler

[patch] patch for CVE-2007-0104 as applied to poppler

poppler-CVE-2007-0104.patch (text/plain), 2.50 KB, created by Michal Jaegermann on 2007-01-25 19:13:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michal Jaegermann

Created: 2007-01-25 19:13:03 UTC

Size: 2.50 KB

patch

obsolete

>--- poppler-0.5.4/poppler/Catalog.cc.CVE-2007-0104	2006-09-13 09:10:52.000000000 -0600
>+++ poppler-0.5.4/poppler/Catalog.cc	2007-01-25 11:08:50.000000000 -0700
>@@ -26,6 +26,12 @@
> #include "UGooString.h"
> #include "Catalog.h"
> 
>+// This define is used to limit the depth of recursive readPageTree calls
>+// This is needed because the page tree nodes can reference their parents
>+// leaving us in an infinite loop
>+// Most sane pdf documents don't have a call depth higher than 10
>+#define MAX_CALL_DEPTH 1000
>+
> //------------------------------------------------------------------------
> // Catalog
> //------------------------------------------------------------------------
>@@ -75,7 +81,7 @@ Catalog::Catalog(XRef *xrefA) {
>     pageRefs[i].num = -1;
>     pageRefs[i].gen = -1;
>   }
>-  numPages = readPageTree(pagesDict.getDict(), NULL, 0);
>+  numPages = readPageTree(pagesDict.getDict(), NULL, 0, 0);
>   if (numPages != numPages0) {
>     error(-1, "Page count in top-level pages object is incorrect");
>   }
>@@ -217,7 +223,7 @@ GooString *Catalog::readMetadata() {
>   return s;
> }
> 
>-int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start) {
>+int Catalog::readPageTree(Dict *pagesDict, PageAttrs *attrs, int start, int callDepth) {
>   Object kids;
>   Object kid;
>   Object kidRef;
>@@ -262,9 +268,13 @@ int Catalog::readPageTree(Dict *pagesDic
>     // This should really be isDict("Pages"), but I've seen at least one
>     // PDF file where the /Type entry is missing.
>     } else if (kid.isDict()) {
>-      if ((start = readPageTree(kid.getDict(), attrs1, start))
>-	  < 0)
>-	goto err2;
>+      if (callDepth > MAX_CALL_DEPTH) {
>+        error(-1, "Limit of %d recursive calls reached while reading the page tree. If your document is correct and not a test to try to force a crash, please report a bug.", MAX_CALL_DEPTH);
>+      } else {
>+        if ((start = readPageTree(kid.getDict(), attrs1, start, callDepth + 1))
>+	    < 0)
>+	  goto err2;
>+      }
>     } else {
>       error(-1, "Kid object (page %d) is wrong type (%s)",
> 	    start+1, kid.getTypeName());
>--- poppler-0.5.4/poppler/Catalog.h.CVE-2007-0104	2006-01-23 07:43:36.000000000 -0700
>+++ poppler-0.5.4/poppler/Catalog.h	2007-01-25 11:10:44.000000000 -0700
>@@ -193,7 +193,7 @@ private:
>   PageMode pageMode;		// page mode
>   PageLayout pageLayout;	// page layout
> 
>-  int readPageTree(Dict *pages, PageAttrs *attrs, int start);
>+  int readPageTree(Dict *pages, PageAttrs *attrs, int start, int callDepth);
>   Object *findDestInTree(Object *tree, GooString *name, Object *obj);
> };
>

Actions: View | Diff

Attachments on bug 224448: 146598