Bug 583738 (CVE-2010-0207)

Summary: CVE-2010-0207 xpdf: XRef table parsing infinite loop
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: mkasik, security-response-team, than
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-04-19 15:50:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Tomas Hoger 2010-04-19 15:36:54 UTC
CERT-FI has provided us with a sample PDF file that causes various xpdf-based PDF viewers to crash.  File causes xpdf to enter an infinite loop, resulting in exhaustion of the stack memory and application crash.

Comment 3 Tomas Hoger 2010-04-19 15:50:57 UTC
Additional details:
xpdf uses XRef::readXRef() (XRef.cc) to read xref object form the PDF file.  This method gets xref object position as an argument.  This calls XRef::readXRefTable() to read "old-style" xref table.  This method parses xref table and reads "trailer" directory.  This trailer may define /XRefStm key, which points to additional xref object (used by linearized PDFs).  XRef::readXRef() is called against with position specified by /XRefStm, which may be identical to the position of the main xref object, resulting in an infinite loop.

This is not considered a security flaw for PDF viewers.

Comment 4 Tomas Hoger 2010-05-19 09:56:36 UTC
Upstream bug: