Bug 95563 - poppler-0.43.0: Crash during drawPngImage
Summary: poppler-0.43.0: Crash during drawPngImage
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: pdftohtml (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-23 20:35 UTC by LE GARREC Vincent
Modified: 2016-05-23 21:19 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
drawPngImage.pdf (1.64 KB, application/pdf)
2016-05-23 20:58 UTC, LE GARREC Vincent
Details
drawPngImage.patch (558 bytes, patch)
2016-05-23 20:59 UTC, LE GARREC Vincent
Details | Splinter Review

Description LE GARREC Vincent 2016-05-23 20:35:59 UTC
Hi, while fuzzing, pdftohtml may crash with invalid image (file enclosed) with poppler-0.43.0 and poppler-0.44.0.

Internal Error: xref num 3 not found but needed, try to reconstruct<0a>
Syntax Error (71): Bad 'Length' attribute in stream
Bogus memory allocation size
Erreur de segmentation (core dumped)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a31626 in GfxImageColorMap::getRGB (this=0x68dc40, x=0x0, 
    rgb=0x7fffffffd130)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/GfxState.cc:6070
6070          color.c[i] = lookup2[i][x[i]];
(gdb) bt
#0  0x00007ffff7a31626 in GfxImageColorMap::getRGB (this=0x68dc40, x=0x0, 
    rgb=0x7fffffffd130)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/GfxState.cc:6070
#1  0x0000000000426592 in HtmlOutputDev::drawPngImage (this=0x679190, 
    state=0x68d3c0, str=0x699530, width=1, height=1, colorMap=0x68dc40, 
    isMask=false) at HtmlOutputDev.cc:1396
#2  0x00007ffff7a06264 in Gfx::doImage (this=0x67d120, ref=0x7fffffffd440, 
    str=0x699530, inlineImg=false)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Gfx.cc:4707
#3  0x00007ffff7a03eea in Gfx::opXObject (this=0x67d120, args=0x7fffffffd580, 
    numArgs=1)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Gfx.cc:4206
#4  0x00007ffff79f0e4c in Gfx::execOp (this=0x67d120, cmd=0x7fffffffd540, 
    args=0x7fffffffd580, numArgs=1)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Gfx.cc:904
#5  0x00007ffff79f06e0 in Gfx::go (this=0x67d120, topLevel=true)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Gfx.cc:763
#6  0x00007ffff79f04b1 in Gfx::display (this=0x67d120, obj=0x7fffffffd8d0, 
    topLevel=true)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Gfx.cc:729
#7  0x00007ffff7a5d0c3 in Page::displaySlice (this=0x67d050, out=0x679190, 
    hDPI=108, vDPI=108, rotate=0, useMediaBox=true, crop=false, sliceX=-1, 
    sliceY=-1, sliceW=-1, sliceH=-1, printing=false, abortCheckCbk=0x0, 
    abortCheckCbkData=0x0, annotDisplayDecideCbk=0x0, 
    annotDisplayDecideCbkData=0x0, copyXRef=false)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Page.cc:599
#8  0x00007ffff7a5cb00 in Page::display (this=0x67d050, out=0x679190, 
    hDPI=108, vDPI=108, rotate=0, useMediaBox=true, crop=false, 
    printing=false, abortCheckCbk=0x0, abortCheckCbkData=0x0, 
    annotDisplayDecideCbk=0x0, annotDisplayDecideCbkData=0x0, copyXRef=false)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/Page.cc:521
#9  0x00007ffff7a60b8f in PDFDoc::displayPage (this=0x677f70, out=0x679190, 
    page=1, hDPI=108, vDPI=108, rotate=0, useMediaBox=true, crop=false, 
    printing=false, abortCheckCbk=0x0, abortCheckCbkData=0x0, 
    annotDisplayDecideCbk=0x0, annotDisplayDecideCbkData=0x0, copyXRef=false)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/PDFDoc.cc:493
#10 0x00007ffff7a60c30 in PDFDoc::displayPages (this=0x677f70, out=0x679190, 
    firstPage=1, lastPage=1, hDPI=108, vDPI=108, rotate=0, useMediaBox=true, 
    crop=false, printing=false, abortCheckCbk=0x0, abortCheckCbkData=0x0, 
    annotDisplayDecideCbk=0x0, annotDisplayDecideCbkData=0x0)
    at /home/legarrec/info/portage/app-text/poppler-0.43.0/work/poppler-0.43.0/poppler/PDFDoc.cc:509
#11 0x00000000004093dd in main (argc=2, argv=<optimized out>)
    at pdftohtml.cc:392
Comment 1 Albert Astals Cid 2016-05-23 20:54:13 UTC
Please attach a file to reproduce.
Comment 2 LE GARREC Vincent 2016-05-23 20:58:00 UTC
Created attachment 124007 [details]
drawPngImage.pdf
Comment 3 LE GARREC Vincent 2016-05-23 20:59:18 UTC
Created attachment 124008 [details] [review]
drawPngImage.patch

Proposal patch.
Comment 4 Albert Astals Cid 2016-05-23 21:19:18 UTC
Pushed, thanks :)


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.