Bug 26048

Summary:	possible buffer overflow in fofi/FoFiType1.cc
Product:	poppler	Reporter:	Gabriel Burt <gabriel.burt>
Component:	general	Assignee:	poppler-bugs <poppler-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:
Attachments:	patch for case where line1 is NULL pdf that should trigger the bug

Description Gabriel Burt 2010-01-14 12:06:18 UTC

Created attachment 32642 [details] [review]
patch for case where line1 is NULL

--- fofi/FoFiType1.cc   2004-01-22 02:26:44.000000000 +0100
+++ fofi/FoFiType1.cc   2009-11-12 20:09:18.000000000 +0100
@@ -163,7 +163,8 @@ void FoFiType1::parse() {
       line = getNextLine(line);
       for (j = 0; j < 300 && line; ++j) {
        line1 = getNextLine(line);
-       if ((n = line1 - line) > 255) {
+        // line1 could be NULL
+       if ((n = line1 - line) > 255 || n < 0) {
          n = 255;
        }
        strncpy(buf, line, n);

Comment 1 Gabriel Burt 2010-01-14 12:06:47 UTC

Created attachment 32643 [details]
pdf that should trigger the bug

Comment 2 Albert Astals Cid 2010-01-14 14:21:47 UTC

fofi/FoFiType1.cc doesn't have that line you mention, it would be good if you sent patches that actually were appliable over current code.

Comment 3 Gabriel Burt 2010-01-14 14:56:17 UTC

I believe you are mistaken:
http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc#n223

The patch applies fine for me on 0.12.2 or git master.

Comment 4 Albert Astals Cid 2010-01-14 15:34:29 UTC

Interesting, the patch you attached is different from the patch you wrote into the bug description...

Comment 5 Albert Astals Cid 2010-01-14 15:39:05 UTC

Anyway line1 - line can never be negative so closing the bug again.

Comment 6 Gabriel Burt 2010-01-14 15:42:52 UTC

The attached PDF opens fine for you?

Comment 7 Albert Astals Cid 2010-01-14 16:03:28 UTC

Open for me: yes
Render properly: no

But your patch is not about fixing rendering, just about fixing a crash that can not happen, look at the code and tell me how line1 is going to be smaller than line.

If you want you can open a different bug about the pdf not rendering correctly, patches to fix that more than welcome.

Comment 8 Albert Astals Cid 2010-01-14 16:18:33 UTC

Sorry last comment is partially wrong.

The file opens and renders correctly for me.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.