| Summary: | Crash in AESV2 protected PDF files | ||
|---|---|---|---|
| Product: | poppler | Reporter: | Pedro Villavicencio <pvillavi> |
| Component: | general | Assignee: | poppler-bugs <poppler-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | critical | ||
| Priority: | medium | CC: | carlosgc, cbergemann |
| Version: | unspecified | ||
| Hardware: | x86 (IA32) | ||
| OS: | Linux (All) | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
|
Description
Pedro Villavicencio
2008-01-08 10:46:47 UTC
Can reproduce with current poppler (master branch) using Qt4 test tools. It is very ugly in valgrind (just spins after this): [bradh@conferta tests]$ valgrind ./test-poppler-qt4 ~/samples/pdf/bug13972.pdf ==7719== Memcheck, a memory error detector. ==7719== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al. ==7719== Using LibVEX rev 1730, a library for dynamic binary translation. ==7719== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP. ==7719== Using valgrind-3.4.0.SVN, a dynamic binary instrumentation framework. ==7719== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al. ==7719== For more details, rerun with: -v ==7719== ==7719== Conditional jump or move depends on uninitialised value(s) ==7719== at 0x4F5FD9D: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:127) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F6BD07: XRef::fetch(int, int, Object*) (XRef.cc:906) ==7719== by 0x4F05963: Catalog::Catalog(XRef*) (XRef.h:79) ==7719== by 0x4F60978: PDFDoc::setup(GooString*, GooString*) (PDFDoc.cc:206) ==7719== by 0x4F60B6E: PDFDoc::PDFDoc(GooString*, GooString*, GooString*, void*) (PDFDoc.cc:102) ==7719== by 0x4C459DA: Poppler::Document::load(QString const&, QByteArray const&, QByteArray const&) (poppler-private.h:106) ==7719== by 0x404E54: main (test-poppler-qt4.cpp:108) ==7719== ==7719== Invalid read of size 1 ==7719== at 0x4F0C11E: DecryptStream::getChar() (Decrypt.cc:271) ==7719== by 0x4F5FD97: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:127) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F6BD07: XRef::fetch(int, int, Object*) (XRef.cc:906) ==7719== by 0x4F05963: Catalog::Catalog(XRef*) (XRef.h:79) ==7719== by 0x4F60978: PDFDoc::setup(GooString*, GooString*) (PDFDoc.cc:206) ==7719== by 0x4F60B6E: PDFDoc::PDFDoc(GooString*, GooString*, GooString*, void*) (PDFDoc.cc:102) ==7719== by 0x4C459DA: Poppler::Document::load(QString const&, QByteArray const&, QByteArray const&) (poppler-private.h:106) ==7719== by 0x404E54: main (test-poppler-qt4.cpp:108) ==7719== Address 0x97a7e08 is 0 bytes after a block of size 328 alloc'd ==7719== at 0x4A06579: operator new(unsigned long) (vg_replace_malloc.c:230) ==7719== by 0x4F5FD4B: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:125) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86) ==7719== by 0x4F6BD07: XRef::fetch(int, int, Object*) (XRef.cc:906) ==7719== by 0x4F05963: Catalog::Catalog(XRef*) (XRef.h:79) ==7719== by 0x4F60978: PDFDoc::setup(GooString*, GooString*) (PDFDoc.cc:206) ==7719== by 0x4F60B6E: PDFDoc::PDFDoc(GooString*, GooString*, GooString*, void*) (PDFDoc.cc:102) ==7719== by 0x4C459DA: Poppler::Document::load(QString const&, QByteArray const&, QByteArray const&) (poppler-private.h:106) ==7719== by 0x404E54: main (test-poppler-qt4.cpp:108) ==7719== ==7719== ERROR SUMMARY: 2967270 errors from 2 contexts (suppressed: 4 from 1) ==7719== malloc/free: in use at exit: 3,584,288 bytes in 3,975 blocks. ==7719== malloc/free: 25,074 allocs, 21,099 frees, 21,535,259,242 bytes allocated. ==7719== For counts of detected errors, rerun with: -v ==7719== searching for pointers to 3,975 not-freed blocks. ==7719== checked 1,292,208 bytes. ==7719== ==7719== LEAK SUMMARY: ==7719== definitely lost: 3,323,330 bytes in 32 blocks. ==7719== possibly lost: 1,656 bytes in 35 blocks. ==7719== still reachable: 259,302 bytes in 3,908 blocks. ==7719== suppressed: 0 bytes in 0 blocks. ==7719== Rerun with --leak-check=full to see details of leaked memory. i tracked it a bit yesterday and seems like the aesDecryptBlock was not filling all the values of state.aes.buf but could not have much more in depth look, it have passed 5 years since i implemented an aes function so i really don't remember much of it :D *** Bug 16092 has been marked as a duplicate of this bug. *** *** Bug 17523 has been marked as a duplicate of this bug. *** Will not crash anymore with poppler 0.9.1 |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.