| Summary: |
Floating point exception vulnerability in poppler 0.59.0 Splash::scaleImageYuXd() |
| Product: |
poppler
|
Reporter: |
Ziqiang Gu <etovio> |
| Component: |
general | Assignee: |
poppler-bugs <poppler-bugs> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
|
| Severity: |
major
|
|
|
| Priority: |
medium
|
|
|
| Version: |
unspecified | |
|
| Hardware: |
All | |
|
| OS: |
Linux (All) | |
|
| Whiteboard: |
|
|
i915 platform:
|
|
i915 features:
|
|
|---|
| Attachments: |
POC file of the vulnerability
|
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.
Created attachment 134210 [details] POC file of the vulnerability A floating point exception vulnerability was found in poppler 0.59.0 Splash.cc Splash::scaleImageYuXd which may lead to potential attack when handling malicious PDF files: gzq@ubuntu:~/work/vul/poppler$ /home/gzq/install/poppler-dev/bin/pdftohtml -q -s mal-Splash-cc-4585-3-67-SIGFPE.pdf a Floating point exception gzq@ubuntu:~/work/vul/poppler$ gdb -q /home/gzq/install/poppler-dev/bin/pdftohtml Reading symbols from /home/gzq/install/poppler-dev/bin/pdftohtml...done. (gdb) r -q -s mal-Splash-cc-4585-3-67-SIGFPE.pdf a Starting program: /home/gzq/install/poppler-dev/bin/pdftohtml -q -s mal-Splash-cc-4585-3-67-SIGFPE.pdf a [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGFPE, Arithmetic exception. 0x0000000000648f31 in Splash::scaleImageYuXd (this=<optimized out>, src=0x429700 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0x7fffffffd270, srcMode=splashModeMono8, nComps=1, srcAlpha=false, srcWidth=10, srcHeight=<optimized out>, scaledWidth=<optimized out>, scaledHeight=3, dest=0xa) at Splash.cc:4585 4585 yq = scaledHeight % srcHeight; (gdb) bt #0 0x0000000000648f31 in Splash::scaleImageYuXd (this=<optimized out>, src=0x429700 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0x7fffffffd270, srcMode=splashModeMono8, nComps=1, srcAlpha=false, srcWidth=10, srcHeight=<optimized out>, scaledWidth=<optimized out>, scaledHeight=3, dest=0xa) at Splash.cc:4585 #1 0x000000000063e551 in Splash::scaleImage (this=<optimized out>, src=<optimized out>, srcData=<optimized out>, srcMode=<optimized out>, nComps=<optimized out>, srcAlpha=<optimized out>, srcWidth=10, srcHeight=<optimized out>, scaledWidth=2, scaledHeight=3, interpolate=2, tilingPattern=2) at Splash.cc:4166 #2 0x000000000063da14 in Splash::drawImage (this=<optimized out>, src=<optimized out>, tf=<optimized out>, srcData=<optimized out>, srcMode=<optimized out>, srcAlpha=<optimized out>, w=<optimized out>, h=<optimized out>, mat=<optimized out>, interpolate=<optimized out>, tilingPattern=<optimized out>) at Splash.cc:3760 #3 0x000000000042fce4 in SplashOutputDev::drawSoftMaskedImage (this=<optimized out>, state=<optimized out>, ref=<optimized out>, str=<optimized out>, width=<optimized out>, height=<optimized out>, colorMap=<optimized out>, interpolate=<optimized out>, maskStr=<optimized out>, maskWidth=<optimized out>, maskHeight=<optimized out>, maskColorMap=<optimized out>, maskInterpolate=<optimized out>) at SplashOutputDev.cc:4054 #4 0x00000000004d36e3 in Gfx::doImage (this=<optimized out>, ref=<optimized out>, str=<optimized out>, inlineImg=<optimized out>) at Gfx.cc:4553 #5 0x00000000004a6700 in Gfx::opXObject (this=0x9e4120, args=<optimized out>, numArgs=<optimized out>) at Gfx.cc:4130 #6 0x00000000004bf976 in Gfx::execOp (this=<optimized out>, cmd=<optimized out>, args=<optimized out>, numArgs=<optimized out>) at Gfx.cc:880 #7 0x00000000004be5f1 in Gfx::go (this=<optimized out>, topLevel=<optimized out>) at Gfx.cc:744 #8 0x00000000004bde55 in Gfx::display (this=<optimized out>, obj=<optimized out>, topLevel=<optimized out>) at Gfx.cc:706 #9 0x0000000000567465 in Page::displaySlice (this=0x9e2e70, out=0x9e3750, hDPI=<optimized out>, vDPI=<optimized out>, rotate=<optimized out>, useMediaBox=<optimized out>, crop=<optimized out>, sliceX=<optimized out>, sliceY=<optimized out>, sliceW=<optimized out>, sliceH=<optimized out>, printing=<optimized out>, abortCheckCbk=<optimized out>, abortCheckCbkData=<optimized out>, annotDisplayDecideCbk=<optimized out>, annotDisplayDecideCbkData=<optimized out>, copyXRef=<optimized out>) at Page.cc:560 #10 0x000000000056719e in Page::display (this=0x0, out=0x429700 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, hDPI=917.99900000000002, vDPI=1187.999, rotate=0, useMediaBox=true, crop=false, printing=false, abortCheckCbk=0x0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0x0, annotDisplayDecideCbkData=0x0, copyXRef=<optimized out>) at Page.cc:481 #11 0x000000000056f0d0 in PDFDoc::displayPage (this=0x9dfe70, out=0x9e3750, page=1, hDPI=<optimized out>, vDPI=<optimized out>, rotate=<optimized out>, useMediaBox=true, crop=<optimized out>, printing=<optimized out>, abortCheckCbk=<optimized out>, abortCheckCbkData=<optimized out>, annotDisplayDecideCbk=<optimized out>, annotDisplayDecideCbkData=<optimized out>, copyXRef=false) at PDFDoc.cc:485 #12 0x00000000004085cf in main (argc=<optimized out>, argv=<optimized out>) at pdftohtml.cc:408 (gdb)