Bug 580105 (CVE-2010-0206) - CVE-2010-0206 xpdf: Invalid pointer dereference by processing JBIG2 PDF stream objects
Summary: CVE-2010-0206 xpdf: Invalid pointer dereference by processing JBIG2 PDF strea...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2010-0206
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-07 13:53 UTC by Jan Lieskovsky
Modified: 2019-09-29 12:36 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-04-19 15:29:59 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 28170 0 None None None Never

Description Jan Lieskovsky 2010-04-07 13:53:55 UTC
An invalid pointer dereference was found in the way xpdf
processed JBIG2 PDF stream objects in the PDF file catalog.
If a local user was tricked into opening a specially-crafted
Portable Document Format (PDF) file, it could lead to denial
of service (xpdf crash) or, potentially, to arbitrary code
execution with the privileges of the user running xpdf.

Comment 11 Josh Bressers 2010-04-14 18:28:38 UTC
(In reply to comment #10)
> i tested xpdf-3.00-23.el4_8.1.i386. The sample1.pdf caused a crash xpdf but no
> crash in pdftops.    

This crash is a NULL pointer dereference:
Program received signal SIGSEGV, Segmentation fault.
0x08076cf4 in ~JArithmeticDecoder (this=0x8838628) at JArithmeticDecoder.cc:107
107	  return (Guint)str->getChar() & 0xff;
(gdb) print str
$1 = (class Stream *) 0x0


I'll do some additional testing, but I suspect this is a DoS only

Comment 12 Josh Bressers 2010-04-14 20:18:32 UTC
I got the same results as above with gpdf and kpdf.

I'm going to write this one off as a DoS only, which matches the results Canonical found.

Comment 15 Tomas Hoger 2010-04-19 15:29:59 UTC
Closing this one not-a-security-bug, as it's NULL pointer dereference only (see comment #11 and comment #12).

Comment 16 Tomas Hoger 2010-04-20 09:41:01 UTC
(In reply to comment #11)

> This crash is a NULL pointer dereference:
> Program received signal SIGSEGV, Segmentation fault.
> 0x08076cf4 in ~JArithmeticDecoder (this=0x8838628) at JArithmeticDecoder.cc:107
> 107   return (Guint)str->getChar() & 0xff;
> (gdb) print str
> $1 = (class Stream *) 0x0

The crash in recent poppler versions is different, but still NULL pointer dereference issue.  JBIG2Bitmap::getSlice() gets called with large values in wA/hA arguments:

http://cgit.freedesktop.org/poppler/poppler/tree/poppler/JBIG2Stream.cc?id=e9501070#n740

It calls JBIG2Bitmap::JBIG2Bitmap():

http://cgit.freedesktop.org/poppler/poppler/tree/poppler/JBIG2Stream.cc?id=e9501070#n700

which contains protection against integer overflow / under-allocation of the data[] buffer, and leaves data set to NULL if integer overflow is detected.

JBIG2Bitmap::getSlice() subsequently calls JBIG2Bitmap::clearToZero(), which does memset(data, ...), resulting in NULL pointer dereference crash.

Comment 17 Tomas Hoger 2010-05-19 09:22:56 UTC
Reported upstream:
  https://bugs.freedesktop.org/show_bug.cgi?id=28170


Note You need to log in before you can comment on or make changes to this bug.