Bug 1575502 - podofo Null Pointer Dereference Denial of Service
Summary: podofo Null Pointer Dereference Denial of Service
Keywords:
Status: NEW
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: podofo
Version: epel7
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
Assignee: Dan Horák
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-07 06:51 UTC by Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd
Modified: 2018-05-22 03:07 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)
crash demo file (2.63 KB, application/pdf)
2018-05-07 06:51 UTC, Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd
no flags Details

Description Zhiyuan Wang of Chengdu Qihoo360 Tech Co. Ltd 2018-05-07 06:51:09 UTC
Created attachment 1432515 [details]
crash demo file

Description of problem:
The function PdfPage::GetPageNumber() in PdfPage.cpp:538 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.


Detailed analysis of crash:

$ gdb podofopdfinfo
(gdb) r crash1.pdf
Starting program: /home/zzuf/pdf-fuzz/crash/podofopdfinfo crash1.pdf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
Document Info
-------------
	File: crash1.pdf
	PDF Version: 1.4
	Page Count: 3

	Fast Web View Enabled: No
	Tagged: No
	Encrypted: No
	Printing Allowed: Yes
	Modification Allowed: Yes
	Copy&Paste Allowed: Yes
	Add/Modify Annotations Allowed: Yes
	Fill&Sign Allowed: Yes
	Accessibility Allowed: Yes
	Document Assembly Allowed: Yes
	High Quality Print Allowed: Yes

Classic Metadata
----------------
	Author: Jonas Jenwald
	Creator: LaTeX with hyperref package
	Subject: 
	Title: Issue 6204 - reduced
	Keywords: 
	Trapped: #FF000#1B00000000000#0D

Page Info
---------
Page Count: 3
Page 0:

Program received signal SIGSEGV, Segmentation fault.
PoDoFo::PdfPage::GetPageNumber (this=0x8079108)
    at /home/zzuf/pdf-fuzz/podofo-0.9.5/src/doc/PdfPage.cpp:538
538	                if( pNode->GetDictionary().GetKey( PdfName::KeyType ) != NULL 


(gdb) list
533	
534	            while( it != kids.end() && (*it).GetReference() != ref )
535	            {
536	                PdfObject* pNode = this->GetObject()->GetOwner()->GetObject( (*it).GetReference() );
537	
538	                if( pNode->GetDictionary().GetKey( PdfName::KeyType ) != NULL 
539	                    && pNode->GetDictionary().GetKey( PdfName::KeyType )->GetName() == PdfName( "Pages" ) )
540	                {
541	                    PdfObject* pCount = pNode->GetIndirectKey( "Count" );
542	                    if( pCount != NULL ) {


(gdb) i r
eax            0x0	0
ecx            0x0	0
edx            0x8070748	134678344
ebx            0xb7fce000	-1208164352
esp            0xbfffed60	0xbfffed60
ebp            0xbfffee68	0xbfffee68
esi            0x8079108	134713608
edi            0x0	0
eip            0xb7ec9f0c	0xb7ec9f0c <PoDoFo::PdfPage::GetPageNumber() const+2172>
eflags         0x10286	[ PF SF IF RF ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51


(gdb) disassemble /m $pc
Dump of assembler code for function PoDoFo::PdfPage::GetPageNumber() const:
...
535	            {
536	                PdfObject* pNode = this->GetObject()->GetOwner()->GetObject( (*it).GetReference() );
   0xb7ec9ef4 <+2148>:	sub    $0x8,%esp
   0xb7ec9ef7 <+2151>:	push   %esi
   0xb7ec9ef8 <+2152>:	mov    -0xd8(%ebp),%esi
   0xb7ec9efe <+2158>:	mov    0x4(%esi),%edx
   0xb7ec9f01 <+2161>:	pushl  0x28(%edx)
   0xb7ec9f04 <+2164>:	call   0xb7bdac70 <_ZNK6PoDoFo13PdfVecObjects9GetObjectERKNS_12PdfReferenceE@plt>
   0xb7ec9f09 <+2169>:	add    $0x10,%esp
   0xb7ec9f10 <+2176>:	mov    %eax,%esi

537	
538	                if( pNode->GetDictionary().GetKey( PdfName::KeyType ) != NULL 
   0xb7ec97ec <+348>:	mov    -0x104(%ebx),%esi
   0xb7ec97f2 <+354>:	lea    -0x9c(%ebp),%ecx
   0xb7ec9814 <+388>:	mov    %esi,-0xc8(%ebp)
   0xb7ec981a <+394>:	lea    0x0(%esi),%esi
   0xb7ec9a18 <+904>:	lea    -0x10(%esp),%esp

Version-Release number of selected component (if applicable):
podofo 0.95

How reproducible:
use podofo/tools/podofopdfinfo to read the attached poc file.

Steps to Reproduce:
1. podofopdfinfo $POC
2.
3.

Actual results:


Expected results:


Additional info:


Note You need to log in before you can comment on or make changes to this bug.