Bug 699685

Created attachment 15533 [details]
the poc file

In Mupdf 1.13,the fz_append_byte function in source/fitz/buffer.c allows remote attackers to cause a denial of service(segmentation fault)via a crafted pdf file.
The main cause is that the pdf_dev_alpha function in source/pdf/pdf-device.c use `#define CURRENT_GSTATE(pdev) (&(pdev)->gstates[(pdev)->num_gstates-1])` to get the gs pointer,however,the pdev->num_gstates may become zero(just the crafted poc file did).The pdev->gstates[-1]->buf is NULL,which will cause the program to crash.
In fz_append_byte `if(buf->len + 1 > buf->cap)` where the buf is NULL.

Here is the back trace in ASAN mode:
```
#0  0x0000000000429d23 in fz_append_byte (ctx=0x601c0000df60, buf=0x0, val=0x2f) at source/fitz/buffer.c:244
#1  0x000000000042a1a0 in fz_append_emit (ctx=0x601c0000df60, buffer=0x0, c=0x2f) at source/fitz/buffer.c:364
#2  0x000000000049e750 in fmtputc (out=0x7fffffffceb0, c=0x2f) at source/fitz/printf.c:35
#3  0x00000000004a0126 in fz_format_string (ctx=0x601c0000df60, user=0x0, emit=0x42a177 <fz_append_emit>,
    fmt=0x76f458 "Alp%d gs\n", args=0x7fffffffcf28) at source/fitz/printf.c:453
#4  0x000000000042a257 in fz_append_printf (ctx=0x601c0000df60, buffer=0x0, fmt=0x76f457 "/Alp%d gs\n")
    at source/fitz/buffer.c:372
#5  0x00000000004d3e2b in pdf_dev_alpha (ctx=0x601c0000df60, pdev=0x60380000f080, alpha=1, stroke=0x1)
    at source/pdf/pdf-device.c:331
#6  0x00000000004d5277 in pdf_dev_stroke_path (ctx=0x601c0000df60, dev=0x60380000f080, path=0x600c0000a4c0,
    stroke=0x601e0000ed70, ctm=..., colorspace=0x602c0000fe00, color=0x60940000a6bc, alpha=1, color_params=0x60940000a6b4)
    at source/pdf/pdf-device.c:656
#7  0x00000000004387a4 in fz_stroke_path (ctx=0x601c0000df60, dev=0x60380000f080, path=0x600c0000a4c0,
    stroke=0x601e0000ed70, ctm=..., colorspace=0x602c0000fe00, color=0x60940000a6bc, alpha=1, color_params=0x60940000a6b4)
    at source/fitz/device.c:133
#8  0x0000000000570e15 in pdf_show_path (ctx=0x601c0000df60, pr=0x60400000fc80, doclose=0x0, dofill=0x0, dostroke=0x1,
    even_odd=0x0) at source/pdf/pdf-op-run.c:695
#9  0x00000000005742f9 in pdf_run_S (ctx=0x601c0000df60, proc=0x60400000fc80) at source/pdf/pdf-op-run.c:1627
#10 0x0000000000561a67 in pdf_process_keyword (ctx=0x601c0000df60, proc=0x60400000fc80, csi=0x7fffffffd6d0,
    stm=0x601000007ba0, word=0x7fffffffd5c8 "S") at source/pdf/pdf-interpret.c:622
#11 0x00000000005633d6 in pdf_process_stream (ctx=0x601c0000df60, proc=0x60400000fc80, csi=0x7fffffffd6d0,
    stm=0x601000007ba0) at source/pdf/pdf-interpret.c:937
#12 0x000000000056371a in pdf_process_contents (ctx=0x601c0000df60, proc=0x60400000fc80, doc=0x60a200012800,
    rdb=0x600600004ed0, stmobj=0x600600004db0, cookie=0x0) at source/pdf/pdf-interpret.c:1031
#13 0x00000000004f4643 in pdf_run_page_contents_with_usage (ctx=0x601c0000df60, doc=0x60a200012800, page=0x601a0000cea0,
    dev=0x60380000f080, ctm=..., usage=0x788390 "View", cookie=0x0) at source/pdf/pdf-run.c:100
#14 0x00000000004f47c2 in pdf_run_page_contents (ctx=0x601c0000df60, page=0x601a0000cea0, dev=0x60380000f080, ctm=...,
    cookie=0x0) at source/pdf/pdf-run.c:129
#15 0x000000000043ae95 in fz_run_page_contents (ctx=0x601c0000df60, page=0x601a0000cea0, dev=0x60380000f080, transform=...,
    cookie=0x0) at source/fitz/document.c:375
#16 0x000000000043afed in fz_run_page (ctx=0x601c0000df60, page=0x601a0000cea0, dev=0x60380000f080, transform=...,
    cookie=0x0) at source/fitz/document.c:407
#17 0x0000000000402def in runpage (number=0x1) at source/tools/muconvert.c:80
#18 0x0000000000402ecb in runrange (range=0x710f64 "") at source/tools/muconvert.c:103
#19 0x0000000000403436 in muconvert_main (argc=0x4, argv=0x7fffffffde30) at source/tools/muconvert.c:185
#20 0x0000000000402af9 in main (argc=0x5, argv=0x7fffffffde28) at source/tools/mutool.c:132
#21 0x00007ffff4578830 in __libc_start_main (main=0x40286f <main>, argc=0x5, argv=0x7fffffffde28, init=<optimized out>,
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffde18) at ../csu/libc-start.c:291
#22 0x0000000000402739 in _start ()
```
how:
./mutool convert -o out.pdf poc1.pdf

Fixed in commit 38f883fe129a5e89306252a4676eaaf4bc968824 (refs/bisect/bad)
Author: Tor Andersson <tor.andersson@artifex.com>
Date:   Mon Oct 22 17:16:35 2018 +0200

    Fix text used as clip mask in pdfwrite device.
    
    Push the clip state, and pass the correct text rendering mode state.

Hi

When build with -O2 apparently the fix is ineffective. See https://bugs.debian.org/924351 . What is missing apart of cherry-picking 38f883fe129a5e89306252a4676eaaf4bc968824 to address CVE-2018-16648?

Regards,
Salvatore

Ok ignore the last comment, the issue seen was caused by the missing commit fa4cdfca9ec3034dbe54e1cb08c8b97e9ebed46d