Bug 698965

Summary: heap-use-after-free in fz_drop_imp
Product: MuPDF Reporter: Kim Gwan Yeong <gy741.kim>
Component: mupdfAssignee: MuPDF bugs <mupdf-bugs>
Status: RESOLVED DUPLICATE    
Severity: normal CC: sebastian.rasmussen
Priority: P4    
Version: unspecified   
Hardware: PC   
OS: Linux   
Customer: Word Size: ---
Attachments: PoC

Description Kim Gwan Yeong 2018-01-29 15:03:44 UTC 
Created attachment 14697 [details]
PoC

Hello.

I found a heap-use-after-free bug in MuPDF.

Please confirm.

Thanks.

OS: Ubuntu 17.10 64bit
Version: commit 148329c60f8ad07886b624b5e9e3d8dfdbbdb98f
Steps to reproduce:
1.Download the .POC files.
2.Compile the source code with ASan.
3.Execute the following command
  : ./mutool info $PoC

```
=================================================================
==3312==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080000000a0 at pc 0x0000007200ee bp 0x7ffecc4651e0 sp 0x7ffecc4651d8
READ of size 4 at 0x6080000000a0 thread T0
    #0 0x7200ed in fz_drop_imp /home/karas/mupdf/source/fitz/fitz-imp.h:191:7
    #1 0x7200ed in fz_drop_stream /home/karas/mupdf/source/fitz/stream-open.c:70
    #2 0x7dcbc9 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:327:3
    #3 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #4 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #5 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #6 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #7 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #8 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #9 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #10 0x7db728 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #11 0x7db728 in build_filter /home/karas/mupdf/source/pdf/pdf-stream.c:182
    #12 0x7dbe9e in build_filter_chain /home/karas/mupdf/source/pdf/pdf-stream.c:262:12
    #13 0x7dd147 in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:364:12
    #14 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #15 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #16 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #17 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #18 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #19 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #20 0x7dee9f in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #21 0x7dee9f in build_compression_params /home/karas/mupdf/source/pdf/pdf-stream.c:126
    #22 0x7db4cf in build_filter /home/karas/mupdf/source/pdf/pdf-stream.c:167:3
    #23 0x7dbe9e in build_filter_chain /home/karas/mupdf/source/pdf/pdf-stream.c:262:12
    #24 0x7dd147 in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:364:12
    #25 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #26 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #27 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #28 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #29 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #30 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #31 0x7dea6c in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #32 0x7dea6c in build_compression_params /home/karas/mupdf/source/pdf/pdf-stream.c:101
    #33 0x7db4cf in build_filter /home/karas/mupdf/source/pdf/pdf-stream.c:167:3
    #34 0x7dbe9e in build_filter_chain /home/karas/mupdf/source/pdf/pdf-stream.c:262:12
    #35 0x7dd147 in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:364:12
    #36 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #37 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #38 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #39 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #40 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #41 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #42 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #43 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #44 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #45 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #46 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #47 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #48 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #49 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #50 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #51 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #52 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #53 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #54 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #55 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #56 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #57 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #58 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #59 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #60 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #61 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #62 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #63 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #64 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #65 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #66 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #67 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #68 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #69 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #70 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #71 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #72 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #73 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #74 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #75 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #76 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #77 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #78 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #79 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #80 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #81 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #82 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #83 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #84 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #85 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #86 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #87 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #88 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #89 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #90 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #91 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #92 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #93 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #94 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #95 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #96 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #97 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #98 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #99 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #100 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #101 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #102 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #103 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #104 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #105 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #106 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #107 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #108 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #109 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #110 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #111 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #112 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #113 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #114 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #115 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #116 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #117 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #118 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #119 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #120 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #121 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #122 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #123 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #124 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #125 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #126 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #127 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #128 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #129 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #130 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #131 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #132 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #133 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #134 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #135 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #136 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #137 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #138 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #139 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #140 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #141 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #142 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #143 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #144 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #145 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #146 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #147 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #148 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #149 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #150 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #151 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #152 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #153 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #154 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #155 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #156 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #157 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #158 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #159 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #160 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #161 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #162 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #163 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #164 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #165 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #166 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #167 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #168 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #169 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #170 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #171 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #172 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #173 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #174 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #175 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #176 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #177 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #178 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #179 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #180 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #181 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #182 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #183 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #184 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #185 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #186 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #187 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #188 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #189 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #190 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #191 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #192 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #193 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #194 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #195 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #196 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #197 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #198 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #199 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #200 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #201 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #202 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #203 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #204 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #205 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #206 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #207 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #208 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #209 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #210 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #211 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #212 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #213 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #214 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #215 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #216 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #217 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #218 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #219 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #220 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #221 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #222 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #223 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #224 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #225 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #226 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #227 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #228 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #229 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #230 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #231 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #232 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #233 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #234 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #235 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #236 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #237 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #238 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #239 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #240 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #241 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #242 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #243 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #244 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #245 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #246 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #247 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #248 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #249 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #250 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #251 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #252 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #253 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #254 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #255 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #256 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #257 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #258 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #259 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #260 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #261 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #262 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #263 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #264 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #265 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #266 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #267 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #268 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #269 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #270 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #271 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #272 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #273 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #274 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #275 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #276 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #277 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #278 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #279 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #280 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #281 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #282 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #283 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #284 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #285 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #286 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #287 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #288 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #289 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #290 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #291 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #292 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #293 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #294 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #295 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #296 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #297 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #298 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #299 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12
    #300 0x80156a in pdf_resolve_indirect_chain /home/karas/mupdf/source/pdf/pdf-xref.c:2051:9
    #301 0x7b1e75 in pdf_objcmp_resolve /home/karas/mupdf/source/pdf/pdf-object.c:411:2
    #302 0x7dc9a2 in pdf_name_eq /home/karas/mupdf/include/mupdf/pdf/object.h:62:10
    #303 0x7dc9a2 in pdf_stream_has_crypt /home/karas/mupdf/source/pdf/pdf-stream.c:51
    #304 0x7dc9a2 in pdf_open_raw_filter /home/karas/mupdf/source/pdf/pdf-stream.c:317
    #305 0x7dcf4b in pdf_open_filter /home/karas/mupdf/source/pdf/pdf-stream.c:348:10
    #306 0x7dcd4a in pdf_open_image_stream /home/karas/mupdf/source/pdf/pdf-stream.c:467:9
    #307 0x7fff6a in pdf_load_obj_stm /home/karas/mupdf/source/pdf/pdf-xref.c:1590:9
    #308 0x7ff4f7 in pdf_cache_object /home/karas/mupdf/source/pdf/pdf-xref.c:1975:8
    #309 0x801437 in pdf_resolve_indirect /home/karas/mupdf/source/pdf/pdf-xref.c:2025:12

0x6080000000a0 is located 0 bytes inside of 88-byte region [0x6080000000a0,0x6080000000f8)
freed by thread T0 here:
    #0 0x4d8c80 in __interceptor_cfree.localalias.0 (/home/karas/mupdf/build/debug/mutool+0x4d8c80)
    #1 0x6a543b in fz_free /home/karas/mupdf/source/fitz/memory.c:201:2

previously allocated by thread T0 here:
    #0 0x4d8e48 in malloc (/home/karas/mupdf/build/debug/mutool+0x4d8e48)
    #1 0x6a3a30 in do_scavenging_malloc /home/karas/mupdf/source/fitz/memory.c:22:7
    #2 0x6a3a30 in fz_calloc /home/karas/mupdf/source/fitz/memory.c:124
    #3 0x71fbf6 in fz_new_stream /home/karas/mupdf/source/fitz/stream-open.c:34:9

SUMMARY: AddressSanitizer: heap-use-after-free /home/karas/mupdf/source/fitz/fitz-imp.h:191:7 in fz_drop_imp
Shadow bytes around the buggy address:
  0x0c107fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c107fff8000: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
=>0x0c107fff8010: fa fa fa fa[fd]fd fd fd fd fd fd fd fd fd fd fa
  0x0c107fff8020: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c107fff8030: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8040: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8050: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
  0x0c107fff8060: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3312==ABORTING
```

=================
[Acknowledgement]
This work was supported by ICT R&D program of MSIP/IITP. [R7518-16-1001, Innovation hub for high Performance Computing]
Comment 1 Sebastian Rasmussen 2018-01-29 15:38:45 UTC 
A quick analysis shows that this is the same issue as in a previously reported bug for which I have a tentative commit awaiting review. That commit does not yet address the entire issue (it takes a HUGE amount of time), but it fixes the crash.

*** This bug has been marked as a duplicate of bug 698830 ***