Attachment 134691 Details for Bug 103116 – Fix-crash-in-fuzzed-file.patch

[patch] Fix-crash-in-fuzzed-file.patch

Fix-crash-in-fuzzed-file.patch (text/plain), 1.21 KB, created by Jason Crain on 2017-10-05 20:40:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jason Crain

Created: 2017-10-05 20:40:47 UTC

Size: 1.21 KB

patch

obsolete

>From 75c84350958d67cc15d12d3dbc858b257971e399 Mon Sep 17 00:00:00 2001
>From: Jason Crain <jason@inspiresomeone.us>
>Date: Thu, 5 Oct 2017 15:32:13 -0500
>Subject: [PATCH] Fix crash in fuzzed file
>
>This file crashes pdftotext because it positions texts past INT_MIN,
>leading to overflow in subsequent calculations.
>
>Bug #103116
>---
> poppler/TextOutputDev.cc | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/poppler/TextOutputDev.cc b/poppler/TextOutputDev.cc
>index d30874cf..d4cf04d3 100644
>--- a/poppler/TextOutputDev.cc
>+++ b/poppler/TextOutputDev.cc
>@@ -889,12 +889,12 @@ void TextPool::addWord(TextWord *word) {
>   TextWord *w0, *w1;
> 
>   // expand the array if needed
>-  if (unlikely((word->base / textPoolStep) > INT_MAX)) {
>-      error(errSyntaxWarning, -1, "word->base / textPoolStep > INT_MAX");
>+  wordBaseIdx = (int)(word->base / textPoolStep);
>+  if (unlikely(wordBaseIdx <= INT_MIN + 128 || wordBaseIdx >= INT_MAX - 128)) {
>+      error(errSyntaxWarning, -1, "wordBaseIdx out of range");
>       delete word;
>       return;
>   }
>-  wordBaseIdx = (int)(word->base / textPoolStep);
>   if (minBaseIdx > maxBaseIdx) {
>     minBaseIdx = wordBaseIdx - 128;
>     maxBaseIdx = wordBaseIdx + 128;
>-- 
>2.14.1
>

Actions: View | Splinter Review

Attachments on bug 103116: 134690 | 134691

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.