| Summary: | Heap out of bounds read in fz_subsample_pixmap() | ||
|---|---|---|---|
| Product: | MuPDF | Reporter: | Kamil Frankowicz <kamil.frankowicz> |
| Component: | mupdf | Assignee: | MuPDF bugs <mupdf-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | ago, robin.watts |
| Priority: | P4 | ||
| Version: | master | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Customer: | Word Size: | --- | |
| Attachments: | POC to trigger heap out of bounds read (mutool) | ||
|
Description
Kamil Frankowicz
2017-01-30 06:13:34 UTC
Sorry, wrong command to reproduce. Should be: mutool draw -F svg mutool_hoobr_fz_subsample_pixmap -o /dev/null This is reproducible with the current stable with the following testcase: https://github.com/asarubbo/poc/blob/master/00148-mupdf-heapoverflow-fz_subsample_pixmap SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/app-text/mupdf-1.10a/work/mupdf-1.10a-source/source/fitz/pixmap.c:1210:12 in fz_subsample_pixmap this is CVE-2017-5896 (In reply to Kamil Frankowicz from comment #0) > To reproduce: mutool draw -F svg mupdf_null_ptr_dodrawpage -o /dev/null This is not a valid invocation of MuPDF. You need to specify the -o before the input file. This used to trigger a SEGV due to the output pointer being uninitialised. This would have happened for any input file, not just this fuzzed one. This bug was fixed in: commit 40ac85bfb676bb4373bda4b18f9fd90268c9f1e9 Author: Sebastian Rasmussen <sebras@gmail.com> Date: Sat Feb 4 06:21:20 2017 +0100 Bug 697514: Write SVG output to stdout if no output specified. So, I am proceeding to check with the latest version of the source (commit 24bfb2d) on 64bit Ubuntu, using: mutool draw -F svg -o /dev/null mupdf_null_ptr_dodrawpage As far as I can tell, this invocation NEVER calls fz_subsample_pixmap... (In reply to Agostino Sarubbo from comment #2) > This is reproducible with the current stable with the following testcase: "current stable" is unhelpful. A git SHA or an exact release name please. Also, on what platform? > https://github.com/asarubbo/poc/blob/master/00148-mupdf-heapoverflow- > fz_subsample_pixmap Please always attach files to the bug. External links have a way of disappearing at inopportune moments. (In reply to Agostino Sarubbo from comment #3) > this is CVE-2017-5896 On Ubuntu 64bit, using commit 24bfb2d798c12c3da44547054331cedb1dcac683, and the command: mutool draw -F svg -o /dev/null mupdf_null_ptr_dodrawpage I cannot see problems with address sanitizer, nor with valgrind. In addition the code never calls fz_subsample_pixmap. I am therefore closing this bug. Feel free to reopen it if you can give me more information as to how to reproduce it. Awww... Sorry for the inconvenience. Once again wrong command... Should be: mutool draw -F png -o /dev/null mutool_hoobr_fz_subsample_pixmap I checked it on 90fa6203ad032fe161d85a3e580941ce3d1216f0 and still exists. (In reply to Robin Watts from comment #5) > "current stable" is unhelpful. A git SHA or an exact release name please. Your current stable is 1.10a, so 1.10a (which is visible from the asan summary) > Also, on what platform? Gentoo x86_64 the command I used was: mutool draw $PDF (In reply to Agostino Sarubbo from comment #8) > (In reply to Robin Watts from comment #5) > > "current stable" is unhelpful. A git SHA or an exact release name please. > Your current stable is 1.10a, so 1.10a (which is visible from the asan > summary) > > > > Also, on what platform? > Gentoo x86_64 > > the command I used was: > mutool draw $PDF I can confirm that I have now reproduced this. Looking into it now. Fixed in: commit 2c4e5867ee699b1081527bc6c6ea0e99a35a5c27 Author: Robin Watts <Robin.Watts@artifex.com> Date: Thu Feb 9 07:12:16 2017 -0800 bug 697515: Fix out of bounds read in fz_subsample_pixmap Pointer arithmetic for final special case was going wrong. Thanks! |