Bug 541614 (CVE-2009-4035)
| Summary: | CVE-2009-4035 xpdf: buffer overflow in FoFiType1::parse | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | kreilly, mkasik, security-response-team, than |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-16 10:53:54 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 543489, 543490, 543491, 543492, 543494, 543495 | ||
| Bug Blocks: | |||
This problem seems to be fixed upstream already. line1 = getNextLine was made part of the for loop control condition, next iteration is not executed when line1 is NULL: http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0 This change is part of the commit: http://cgit.freedesktop.org/poppler/poppler/commit/?id=4b4fc5c0 which suggests xpdf was fixed upstream in between version 3.00 and 3.01. Older xpdf versions (2.x) have similar code in xpdf/FontFile.cc, Type1FontFile::Type1FontFile, but the nextLine there does not return NULL. Lifting embargo. This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1680 https://rhn.redhat.com/errata/RHSA-2009-1680.html This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1681 https://rhn.redhat.com/errata/RHSA-2009-1681.html This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2009:1682 https://rhn.redhat.com/errata/RHSA-2009-1682.html |
SuSE reported a buffer overflow in FoFiType1::parse affecting older xpdf versions. Code snippets from fofi/FoFiType1.cc: 133 void FoFiType1::parse() { ... 163 line = getNextLine(line); 164 for (j = 0; j < 300 && line; ++j) { 165 line1 = getNextLine(line); 166 if ((n = line1 - line) > 255) { 167 n = 255; 168 } 169 strncpy(buf, line, n); getNextLine can, however, return NULL: 117 char *FoFiType1::getNextLine(char *line) { 118 while (line < (char *)file + len && *line != '\x0a' && *line != '\x0d') { 119 ++line; 120 } 121 if (line < (char *)file + len && *line == '\x0d') { 122 ++line; 123 } 124 if (line < (char *)file + len && *line == '\x0a') { 125 ++line; 126 } 127 if (line >= (char *)file + len) { 128 return NULL; 129 } Therefore, (line1 - line) is not defined / results in negative value n. That value is later passed to strncpy, causing overflow of buf buffer.