| Summary: | mutool v1.11 heap overflow issue 1 | ||
|---|---|---|---|
| Product: | MuPDF | Reporter: | Ziqiang Gu <etovio> |
| Component: | mupdf | Assignee: | MuPDF bugs <mupdf-bugs> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | robin.watts, tor.andersson |
| Priority: | P4 | ||
| Version: | unspecified | ||
| Hardware: | PC | ||
| OS: | Windows NT | ||
| Customer: | Word Size: | --- | |
| Attachments: | POC file of the vulnerability | ||
|
Description
Ziqiang Gu
2017-10-26 00:57:44 UTC
For future reference, it would be helpful if you ran ASAN's output through the symbolizer so we can see file names and line numbers rather than random hex addresses. Putting something like the following in your .bashrc will do it automatically: export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer-3.5 export ASAN_OPTIONS=symbolize=1 With mutool clean -gg I get:
WRITE of size 4 at 0x60d00000ce60 thread T0
#0 0xe724e6 in dowriteobject /home/tor/src/mupdf/source/pdf/pdf-write.c:2162:3
#1 0xe4ef64 in writeobjects /home/tor/src/mupdf/source/pdf/pdf-write.c:2218:3
#2 0xe39c3d in do_pdf_save_document /home/tor/src/mupdf/source/pdf/pdf-write.c:2937:4
#3 0xe3c8bd in pdf_save_document /home/tor/src/mupdf/source/pdf/pdf-write.c:3078:3
#4 0xc6743d in pdf_clean_file /home/tor/src/mupdf/source/pdf/pdf-clean-file.c:336:3
#5 0x5a6526 in pdfclean_main /home/tor/src/mupdf/source/tools/pdfclean.c:94:3
#6 0x4f6865 in main /home/tor/src/mupdf/source/tools/mutool.c:127:12
With mutool clean -ggg I get:
READ of size 4 at 0x60d00000cf30 thread T0
#0 0xe462ae in removeduplicateobjs /home/tor/src/mupdf/source/pdf/pdf-write.c:647:8
#1 0xe37e52 in do_pdf_save_document /home/tor/src/mupdf/source/pdf/pdf-write.c:2879:4
#2 0xe3c8bd in pdf_save_document /home/tor/src/mupdf/source/pdf/pdf-write.c:3078:3
#3 0xc6743d in pdf_clean_file /home/tor/src/mupdf/source/pdf/pdf-clean-file.c:336:3
#4 0x5a6526 in pdfclean_main /home/tor/src/mupdf/source/tools/pdfclean.c:94:3
#5 0x4f6865 in main /home/tor/src/mupdf/source/tools/mutool.c:127:12
I have a fix awaiting review. Fixed in: commit 520cc26d18c9ee245b56e9e91f9d4fcae02be5f0 (golden/master) Author: Robin Watts <robin.watts@artifex.com> Date: Tue Nov 7 19:21:58 2017 +0000 Bug 689699: Avoid buffer overrun. When cleaning a pdf file, various lists (of pdf_xref_len length) are defined early on. If we trigger a repair during the clean, this can cause pdf_xref_len to increase causing an overrun. Fix this by watching for changes in the length, and checking accesses to the list for validity. This also appears to fix bugs 698700-698703. Thanks for the report! |