Bug 26048 - possible buffer overflow in fofi/FoFiType1.cc
Summary: possible buffer overflow in fofi/FoFiType1.cc
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-01-14 12:06 UTC by Gabriel Burt
Modified: 2010-01-14 16:18 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
patch for case where line1 is NULL (545 bytes, patch)
2010-01-14 12:06 UTC, Gabriel Burt
Details | Splinter Review
pdf that should trigger the bug (407.09 KB, application/pdf)
2010-01-14 12:06 UTC, Gabriel Burt
Details

Description Gabriel Burt 2010-01-14 12:06:18 UTC
Created attachment 32642 [details] [review]
patch for case where line1 is NULL

--- fofi/FoFiType1.cc   2004-01-22 02:26:44.000000000 +0100
+++ fofi/FoFiType1.cc   2009-11-12 20:09:18.000000000 +0100
@@ -163,7 +163,8 @@ void FoFiType1::parse() {
       line = getNextLine(line);
       for (j = 0; j < 300 && line; ++j) {
        line1 = getNextLine(line);
-       if ((n = line1 - line) > 255) {
+        // line1 could be NULL
+       if ((n = line1 - line) > 255 || n < 0) {
          n = 255;
        }
        strncpy(buf, line, n);
Comment 1 Gabriel Burt 2010-01-14 12:06:47 UTC
Created attachment 32643 [details]
pdf that should trigger the bug
Comment 2 Albert Astals Cid 2010-01-14 14:21:47 UTC
fofi/FoFiType1.cc doesn't have that line you mention, it would be good if you sent patches that actually were appliable over current code.
Comment 3 Gabriel Burt 2010-01-14 14:56:17 UTC
I believe you are mistaken:
http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc#n223

The patch applies fine for me on 0.12.2 or git master.
Comment 4 Albert Astals Cid 2010-01-14 15:34:29 UTC
Interesting, the patch you attached is different from the patch you wrote into the bug description...
Comment 5 Albert Astals Cid 2010-01-14 15:39:05 UTC
Anyway line1 - line can never be negative so closing the bug again.
Comment 6 Gabriel Burt 2010-01-14 15:42:52 UTC
The attached PDF opens fine for you?
Comment 7 Albert Astals Cid 2010-01-14 16:03:28 UTC
Open for me: yes
Render properly: no

But your patch is not about fixing rendering, just about fixing a crash that can not happen, look at the code and tell me how line1 is going to be smaller than line.

If you want you can open a different bug about the pdf not rendering correctly, patches to fix that more than welcome.
Comment 8 Albert Astals Cid 2010-01-14 16:18:33 UTC
Sorry last comment is partially wrong.

The file opens and renders correctly for me.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.