Bug 1531897 - Integer Overflow in PdfXRefStreamParserObject::ParseStream
Summary: Integer Overflow in PdfXRefStreamParserObject::ParseStream
Keywords:
Status: NEW
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: podofo
Version: epel7
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Dan Horák
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-01-06 14:43 UTC by probefuzzer
Modified: 2018-01-11 21:48 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)
PoC to trigger this vulnerability (871 bytes, application/pdf)
2018-01-06 14:45 UTC, probefuzzer
no flags Details

Description probefuzzer 2018-01-06 14:43:42 UTC
on latest version of PoDoFo (RELEASE_0.9.5_rc1), there is an integer overflow in the PdfXRefStreamParserObject::ParseStream function (src/base/PdfXRefStreamParserObject.cpp), which can cause denial of service via a crafted pdf file.

src/src/base/PdfXRefStreamParserObject.cpp:125:64: runtime error: signed integer overflow: 3 + 9223372036854775807 cannot be represented in type 'long int [3]'

To reproduce the issue, compile PoDoFo with UBSAN "-fsanitize=undefined", then execute: podofoimgextract $POC OUTPUT_DIR

The POC file can be downloaded from:
https://github.com/ProbeFuzzer/poc/blob/master/podofo/podofo_0-9-5-rc1_podofoimgextract_integer-overflow_PdfXRefStreamParserObject-ParseStream.pdf

Comment 1 probefuzzer 2018-01-06 14:45:00 UTC
Created attachment 1377905 [details]
PoC to trigger this vulnerability

Comment 2 Salvatore Bonaccorso 2018-01-08 20:18:01 UTC
@probefuzzer: This issue was assigned CVE-2018-5295, was it reported upstream?

Comment 3 probefuzzer 2018-01-11 21:48:11 UTC
(In reply to Salvatore Bonaccorso from comment #2)
> @probefuzzer: This issue was assigned CVE-2018-5295, was it reported
> upstream?

Thanks for your work. 
We have notified podofo developers via mailing list.


Note You need to log in before you can comment on or make changes to this bug.