An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc. Reference: https://gitlab.freedesktop.org/poppler/poppler/issues/751
Created poppler tracking bugs for this issue: Affects: fedora-all [bug 1696640]
Easy to reproduce. ``` ==12415== Memcheck, a memory error detector ==12415== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==12415== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info ==12415== Command: pdftops -level1sep poc /dev/null ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FAD6F8: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e00 is 0 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FAD6FC: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e01 is 1 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FAD709: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e02 is 2 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FADF2C: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e00 is 0 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FADF30: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e00 is 0 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== Invalid read of size 1 ==12415== at 0x4FADF57: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== by 0x6D96504: (below main) (in /usr/lib64/libc-2.17.so) ==12415== Address 0x7d79e00 is 0 bytes after a block of size 519,168 alloc'd ==12415== at 0x4C29E63: malloc (vg_replace_malloc.c:309) ==12415== by 0x4FD1F81: gmallocn_checkoverflow (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FF82BF: SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4EF920D: SplashOutputDev::startPage(int, GfxState*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F4242E: Gfx::Gfx(PDFDoc*, OutputDev*, int, Dict*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A05D: Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, XRef*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A360: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4FAD110: PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A296: Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F8A569: Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x4F91A0C: PDFDoc::displayPages(OutputDev*, int, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) (in /usr/lib64/libpoppler.so.46.0.0) ==12415== by 0x402130: ??? (in /usr/bin/pdftops) ==12415== ==12415== ==12415== HEAP SUMMARY: ==12415== in use at exit: 12,861 bytes in 29 blocks ==12415== total heap usage: 6,851 allocs, 6,822 frees, 1,684,429 bytes allocated ==12415== ==12415== LEAK SUMMARY: ==12415== definitely lost: 0 bytes in 0 blocks ==12415== indirectly lost: 0 bytes in 0 blocks ==12415== possibly lost: 0 bytes in 0 blocks ==12415== still reachable: 12,861 bytes in 29 blocks ==12415== suppressed: 0 bytes in 0 blocks ==12415== Rerun with --leak-check=full to see details of leaked memory ==12415== ==12415== For counts of detected and suppressed errors, rerun with: -v ==12415== ERROR SUMMARY: 212 errors from 6 contexts (suppressed: 0 from 0) ``` checkPageSlice invalid read looks to match upstream "heap-buffer-overflow"
For Red Hat Enterprise Linux 6: ``` Error: pdftops was built without CMYK support, level1sep needs it to work in this file ``` Played around with the CLI options a bit, unable to reproduce the invalid read via valgrind. Hence, does not appear to be vulnerable.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2713 https://access.redhat.com/errata/RHSA-2019:2713
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10871
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:1074 https://access.redhat.com/errata/RHSA-2020:1074