Bug 697400

Summary: Stack Overflow in count_entries source()
Product: MuPDF Reporter: Kamil Frankowicz <kamil.frankowicz>
Component: mupdfAssignee: MuPDF bugs <mupdf-bugs>
Status: RESOLVED FIXED    
Severity: normal CC: sebastian.rasmussen
Priority: P4    
Version: master   
Hardware: PC   
OS: Linux   
Customer: Word Size: ---
Attachments: POC to trigger stack overflow (mutool)

Description Kamil Frankowicz 2016-12-01 02:44:19 UTC 
Created attachment 13183 [details]
POC to trigger stack overflow (mutool)

Too much recursion cause stack-overflow in count_entries source()

Affected Git HEAD: a1761e60a23a3c26ce884dc2fcabdf1e6f8f0ecb

To reproduce: mutool info mupdf_so_count_entries source.pdf

ASAN Output:

==10527==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe09340ff8 (pc 0x0000005b6e45 bp 0x7ffe09341020 sp 0x7ffe09340fe0 T0)
    #0 0x5b6e44 in pdf_get_xref_entry source/pdf/pdf-xref.c:243
    #1 0x5c3b44 in pdf_cache_object source/pdf/pdf-xref.c:1889
    #2 0x5c4a43 in pdf_resolve_indirect source/pdf/pdf-xref.c:1999
    #3 0x5c4ba9 in pdf_resolve_indirect_chain source/pdf/pdf-xref.c:2025
    #4 0x5d84bb in pdf_array_len source/pdf/pdf-object.c:625
    #5 0x585deb in count_entries source/pdf/pdf-layer.c:86
    #6 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #7 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #8 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #9 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #10 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #11 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #12 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #13 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #14 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #15 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #16 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #17 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #18 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #19 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #20 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #21 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #22 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #23 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #24 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #25 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #26 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #27 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #28 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #29 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #30 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #31 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #32 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #33 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #34 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #35 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #36 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #37 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #38 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #39 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #40 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #41 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #42 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #43 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #44 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #45 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #46 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #47 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #48 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #49 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #50 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #51 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #52 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #53 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #54 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #55 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #56 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #57 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #58 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #59 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #60 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #61 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #62 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #63 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #64 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #65 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #66 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #67 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #68 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #69 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #70 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #71 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #72 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #73 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #74 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #75 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #76 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #77 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #78 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #79 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #80 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #81 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #82 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #83 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #84 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #85 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #86 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #87 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #88 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #89 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #90 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #91 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #92 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #93 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #94 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #95 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #96 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #97 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #98 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #99 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #100 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #101 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #102 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #103 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #104 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #105 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #106 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #107 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #108 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #109 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #110 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #111 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #112 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #113 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #114 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #115 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #116 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #117 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #118 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #119 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #120 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #121 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #122 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #123 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #124 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #125 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #126 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #127 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #128 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #129 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #130 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #131 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #132 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #133 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #134 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #135 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #136 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #137 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #138 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #139 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #140 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #141 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #142 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #143 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #144 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #145 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #146 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #147 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #148 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #149 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #150 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #151 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #152 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #153 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #154 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #155 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #156 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #157 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #158 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #159 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #160 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #161 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #162 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #163 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #164 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #165 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #166 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #167 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #168 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #169 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #170 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #171 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #172 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #173 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #174 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #175 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #176 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #177 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #178 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #179 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #180 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #181 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #182 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #183 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #184 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #185 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #186 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #187 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #188 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #189 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #190 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #191 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #192 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #193 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #194 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #195 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #196 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #197 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #198 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #199 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #200 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #201 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #202 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #203 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #204 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #205 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #206 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #207 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #208 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #209 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #210 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #211 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #212 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #213 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #214 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #215 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #216 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #217 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #218 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #219 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #220 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #221 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #222 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #223 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #224 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #225 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #226 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #227 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #228 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #229 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #230 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #231 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #232 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #233 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #234 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #235 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #236 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #237 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #238 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #239 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #240 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #241 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #242 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #243 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #244 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #245 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #246 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #247 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #248 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #249 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #250 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #251 0x585e42 in count_entries source/pdf/pdf-layer.c:93

SUMMARY: AddressSanitizer: stack-overflow source/pdf/pdf-xref.c:243 pdf_get_xref_entry
==10527==ABORTING

Regards,
Kamil Frankowicz
Comment 1 Sebastian Rasmussen 2017-04-08 19:51:54 UTC 
This was fixed in 2590fed7a355a421f062ebd4293df892800fa7ac.