Bug 697400 - Stack Overflow in count_entries source()
Summary: Stack Overflow in count_entries source()
Status: RESOLVED FIXED
Alias: None
Product: MuPDF
Classification: Unclassified
Component: mupdf (show other bugs)
Version: master
Hardware: PC Linux
: P4 normal
Assignee: MuPDF bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-01 02:44 UTC by Kamil Frankowicz
Modified: 2017-04-08 19:51 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---

Attachments
POC to trigger stack overflow (mutool) (89 bytes, application/pdf)
2016-12-01 02:44 UTC, Kamil Frankowicz 		Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kamil Frankowicz 2016-12-01 02:44:19 UTC 
Created attachment 13183 [details]
POC to trigger stack overflow (mutool)

Too much recursion cause stack-overflow in count_entries source()

Affected Git HEAD: a1761e60a23a3c26ce884dc2fcabdf1e6f8f0ecb

To reproduce: mutool info mupdf_so_count_entries source.pdf

ASAN Output:

==10527==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe09340ff8 (pc 0x0000005b6e45 bp 0x7ffe09341020 sp 0x7ffe09340fe0 T0)
    #0 0x5b6e44 in pdf_get_xref_entry source/pdf/pdf-xref.c:243
    #1 0x5c3b44 in pdf_cache_object source/pdf/pdf-xref.c:1889
    #2 0x5c4a43 in pdf_resolve_indirect source/pdf/pdf-xref.c:1999
    #3 0x5c4ba9 in pdf_resolve_indirect_chain source/pdf/pdf-xref.c:2025
    #4 0x5d84bb in pdf_array_len source/pdf/pdf-object.c:625
    #5 0x585deb in count_entries source/pdf/pdf-layer.c:86
    #6 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #7 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #8 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #9 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #10 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #11 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #12 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #13 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #14 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #15 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #16 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #17 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #18 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #19 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #20 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #21 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #22 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #23 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #24 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #25 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #26 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #27 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #28 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #29 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #30 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #31 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #32 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #33 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #34 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #35 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #36 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #37 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #38 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #39 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #40 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #41 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #42 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #43 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #44 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #45 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #46 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #47 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #48 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #49 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #50 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #51 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #52 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #53 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #54 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #55 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #56 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #57 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #58 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #59 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #60 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #61 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #62 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #63 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #64 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #65 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #66 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #67 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #68 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #69 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #70 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #71 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #72 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #73 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #74 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #75 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #76 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #77 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #78 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #79 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #80 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #81 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #82 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #83 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #84 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #85 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #86 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #87 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #88 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #89 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #90 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #91 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #92 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #93 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #94 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #95 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #96 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #97 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #98 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #99 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #100 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #101 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #102 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #103 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #104 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #105 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #106 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #107 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #108 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #109 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #110 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #111 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #112 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #113 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #114 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #115 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #116 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #117 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #118 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #119 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #120 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #121 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #122 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #123 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #124 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #125 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #126 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #127 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #128 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #129 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #130 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #131 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #132 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #133 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #134 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #135 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #136 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #137 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #138 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #139 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #140 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #141 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #142 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #143 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #144 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #145 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #146 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #147 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #148 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #149 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #150 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #151 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #152 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #153 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #154 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #155 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #156 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #157 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #158 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #159 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #160 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #161 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #162 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #163 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #164 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #165 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #166 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #167 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #168 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #169 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #170 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #171 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #172 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #173 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #174 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #175 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #176 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #177 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #178 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #179 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #180 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #181 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #182 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #183 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #184 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #185 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #186 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #187 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #188 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #189 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #190 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #191 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #192 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #193 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #194 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #195 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #196 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #197 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #198 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #199 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #200 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #201 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #202 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #203 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #204 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #205 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #206 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #207 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #208 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #209 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #210 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #211 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #212 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #213 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #214 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #215 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #216 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #217 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #218 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #219 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #220 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #221 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #222 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #223 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #224 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #225 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #226 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #227 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #228 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #229 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #230 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #231 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #232 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #233 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #234 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #235 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #236 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #237 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #238 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #239 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #240 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #241 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #242 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #243 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #244 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #245 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #246 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #247 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #248 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #249 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #250 0x585e42 in count_entries source/pdf/pdf-layer.c:93
    #251 0x585e42 in count_entries source/pdf/pdf-layer.c:93

SUMMARY: AddressSanitizer: stack-overflow source/pdf/pdf-xref.c:243 pdf_get_xref_entry
==10527==ABORTING

Regards,
Kamil Frankowicz
Comment 1 Sebastian Rasmussen 2017-04-08 19:51:54 UTC 
This was fixed in 2590fed7a355a421f062ebd4293df892800fa7ac.