Created attachment 120651 [details]
Test case (PoC, crashdump, stack trace)

Hi,

We found a memory corruption during fuzzing in a different type of PDF reader / viewer. Upon analysis, we found that bug leads to libpoppler library. The issue happened when "ExtGState" is not a valid blend mode. We noticed this is related to security issue. We have attached all the information needed for your testing.

Our lab test: Ubuntu 14.04.3 LTS (trusty)
PDF viewer / reader: diffpdf, evince, gpdftext, pdf-presenter-console, xpdf, zathura_viewer, qpdfview


Example testing:

labs@autobot:~/warez/pdf$ qpdfview crash.pdf 
"Error (10431): Invalid blend mode in ExtGState" 
*** Error in `qpdfview': malloc(): memory corruption: 0xb217ca10 ***
Aborted

Code:

GBool Gfx::checkTransparencyGroup(Dict *resDict) {
  // check the effect of compositing objects as a group:
  // look for ExtGState entries with ca != 1 or CA != 1 or BM != normal
  Object extGStates;
  GBool transpGroup = gFalse;
  double opac;

  if (resDict == NULL)
    return gFalse;
  pushResources(resDict);
  resDict->lookup("ExtGState", &extGStates);
  if (extGStates.isDict()) {
    Dict *dict = extGStates.getDict();
    for (int i = 0; i < dict->getLength() && !transpGroup; i++) {
      Object obj1, obj2;
      GfxBlendMode mode;

      if (res->lookupGState(dict->getKey(i), &obj1) && obj1.isDict()) {
        if (!obj1.dictLookup("BM", &obj2)->isNull()) { 
          if (state->parseBlendMode(&obj2, &mode)) { // failed processing blend mode
            if (mode != gfxBlendNormal)		// true
              transpGroup = gTrue;
          } else {	// 
            error(errSyntaxError, getPos(), "Invalid blend mode in ExtGState");
          }
        }


Thanks!