Bug 97005 - Segfault / invalid read in Hints::Hints / PDFDoc::checkLinearization when using pdfinfo
Summary: Segfault / invalid read in Hints::Hints / PDFDoc::checkLinearization when usi...
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: utils (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-20 14:49 UTC by Jake Yamaki
Modified: 2016-07-30 15:51 UTC (History)
2 users (show)

See Also:
i915 platform:
i915 features:

Attachments
crashing testcase (9.13 KB, text/x-matlab)
2016-07-20 14:49 UTC, Jake Yamaki 		Details
View All

Description Jake Yamaki 2016-07-20 14:49:06 UTC 
Created attachment 125157 [details]
crashing testcase

Found with american fuzzy lop.  See attached for crashing testcase.

> valgrind pdfinfo file.min
...snip...
==28152== Invalid read of size 8
==28152==    at 0x505C553: Hints::Hints(BaseStream*, Linearization*, XRef*, SecurityHandler*) (Hints.cc:46)
==28152==    by 0x50B772B: PDFDoc::checkLinearization() (PDFDoc.cc:560)
==28152==    by 0x50B6D11: PDFDoc::getPage(int) (PDFDoc.cc:2006)
==28152==    by 0x408690: JSInfo::scan(int) (JSInfo.cc:165)
==28152==    by 0x40366D: main (pdfinfo.cc:286)
==28152==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==28152== 
==28152== Process terminating with default action of signal 11 (SIGSEGV)
==28152==  Access not within mapped region at address 0x0
...snip...
Comment 1 Jake Yamaki 2016-07-20 16:40:35 UTC 
I have confirmed this on both the 0.45.0 stable release and the git repo
Comment 2 Brian Martin 2016-07-25 23:08:24 UTC 
Was this resolved in poppler-0.46.0.tar.xz (Mon Jul 25, 2016)?
Comment 3 Albert Astals Cid 2016-07-25 23:21:26 UTC 
is the bug marked as fixed?
Comment 4 Jake Yamaki 2016-07-26 12:43:57 UTC 
This is not fixed in poppler-0.46.0.tar.xz (Mon Jul 25, 2016).

GDB (on 0.46.0): 

Hints::Hints (this=0x64ca00, str=0x64bf10, linearization=0x64c0f0, xref=0x64c110, secHdlr=0x0) at Hints.cc:46
46	  pageOffsetFirst = xref->getEntry(pageObjectFirst)->offset;
Comment 5 Albert Astals Cid 2016-07-30 15:51:05 UTC 
Fixed

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.