[Poppler-bugs] [Bug 76445] New: SEGV in RescaleDrawImage::getRow

Fri Mar 21 04:36:48 PDT 2014

https://bugs.freedesktop.org/show_bug.cgi?id=76445

          Priority: medium
            Bug ID: 76445
          Assignee: poppler-bugs at lists.freedesktop.org
           Summary: SEGV in RescaleDrawImage::getRow
          Severity: normal
    Classification: Unclassified
                OS: Linux (All)
          Reporter: a.husa at hushmail.com
          Hardware: x86-64 (AMD64)
            Status: NEW
           Version: unspecified
         Component: cairo backend
           Product: poppler

Created attachment 96155
  --> https://bugs.freedesktop.org/attachment.cgi?id=96155&action=edit
Fuzzed PDF file that causes SEGV

Segfault when malformed PDF file is opened.

Reproduced on Evince, Zathura and apvlv with Poppler version 0.24.5.

Distrubution: Gentoo Linux 64bit
Evince version: 3.10.3
Zathura version: 0.2.1
Zathura-pdf-poppler version: 0.2.3

Malformed file is given as an attachment.

ASAN report:
==895== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x7f177e460be5 sp 0x7f177b474880 bp 0x7f177b474900 T3)
AddressSanitizer can not provide additional info.
    #0 0x7f177e460be4 (/usr/lib64/libpoppler-glib.so.8.6.0+0x5fbe4)
    #1 0x7f177e46187b (/usr/lib64/libpoppler-glib.so.8.6.0+0x6087b)
    #2 0x7f177e45df30 (/usr/lib64/libpoppler-glib.so.8.6.0+0x5cf30)
    #3 0x7f177dd69b43 (/usr/lib64/libpoppler.so.44.0.0+0x233b43)
    #4 0x7f177dd6d0a1 (/usr/lib64/libpoppler.so.44.0.0+0x2370a1)
    #5 0x7f177dd5bb45 (/usr/lib64/libpoppler.so.44.0.0+0x225b45)
    #6 0x7f177dd5c50f (/usr/lib64/libpoppler.so.44.0.0+0x22650f)
    #7 0x7f177de186d7 (/usr/lib64/libpoppler.so.44.0.0+0x2e26d7)
    #8 0x7f177e435a92 (/usr/lib64/libpoppler-glib.so.8.6.0+0x34a92)
    #9 0x7f177e69cca4 (/usr/lib64/zathura/pdf.so+0x3ca4)
    #10 0x42f8b7 (/usr/bin/zathura+0x42f8b7)
    #11 0x7f17868caea5 (/usr/lib64/libglib-2.0.so.0.3800.2+0x6fea5)
    #12 0x7f17868ca4e4 (/usr/lib64/libglib-2.0.so.0.3800.2+0x6f4e4)
    #13 0x7f1787f7dc07 (/usr/lib64/libasan.so.0.0.0+0x18c07)
    #14 0x7f1786240f39 (/lib64/libpthread-2.17.so+0x8f39)
    #15 0x7f1785c7dc3c (/lib64/libc-2.17.so+0xedc3c)
Thread T3 (pool) created by T0 here:
    #0 0x7f1787f6fc5b (/usr/lib64/libasan.so.0.0.0+0xac5b)
    #1 0x7f17868e5941 (/usr/lib64/libglib-2.0.so.0.3800.2+0x8a941)
==895== ABORTING

gdb backtrace:
0x00007fffeb348be5 in RescaleDrawImage::getRow (this=0x7fffe835cc80,
row_num=<optimized out>, row_data=0x607400007900) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/CairoOutputDev.cc:2845
2845            rgb = lookup[*p];

gdb$ bt
#0  0x00007fffeb348be5 in RescaleDrawImage::getRow (this=0x7fffe835cc80,
row_num=<optimized out>, row_data=0x607400007900) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/CairoOutputDev.cc:2845
#1  0x00007fffeb34987c in CairoRescaleBox::downScaleImage
(this=this at entry=0x7fffe835cc80, orig_width=<optimized out>,
orig_height=orig_height at entry=0xdb3, scaled_width=scaled_width at entry=0x198,
scaled_height=scaled_height at entry=0x242, start_column=start_column at entry=0x0,
start_row=start_row at entry=0x0, width=width at entry=0x198,
height=height at entry=0x242, dest_surface=dest_surface at entry=0x602c0001fa00) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/CairoRescaleBox.cc:338
#2  0x00007fffeb345f31 in getSourceImage (maskColorsA=0x0,
colorMapA=0x60440002f880, printing=0x0, scaledHeight=0x242, scaledWidth=0x198,
height=0xdb3, widthA=0x9b0, str=0x601800047b00, this=0x7fffe835cc80) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/CairoOutputDev.cc:2817
#3  CairoOutputDev::drawImage (this=0x603600004540, state=<optimized out>,
ref=0x7fffe835d2c0, str=0x601800047b00, widthA=0x9b0, heightA=0xdb3,
colorMap=0x60440002f880, interpolate=0x0, maskColors=0x0, inlineImg=0x0) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/CairoOutputDev.cc:2896
#4  0x00007fffeac51b44 in Gfx::doImage (this=this at entry=0x60240007f5c0,
ref=ref at entry=0x7fffe835d2c0, str=<optimized out>,
inlineImg=inlineImg at entry=0x0) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/Gfx.cc:4587
#5  0x00007fffeac550a2 in Gfx::opXObject (this=0x60240007f5c0, args=<optimized
out>, numArgs=<optimized out>) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/Gfx.cc:4128
#6  0x00007fffeac43b46 in Gfx::go (this=this at entry=0x60240007f5c0,
topLevel=topLevel at entry=0x1) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/Gfx.cc:712
#7  0x00007fffeac44510 in Gfx::display (this=this at entry=0x60240007f5c0,
obj=obj at entry=0x7fffe835d9d0, topLevel=topLevel at entry=0x1) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/Gfx.cc:678
#8  0x00007fffead006d8 in Page::displaySlice (this=0x6022000191e0,
out=out at entry=0x603600004540, hDPI=hDPI at entry=72, vDPI=vDPI at entry=72,
rotate=rotate at entry=0x0, useMediaBox=useMediaBox at entry=0x0,
crop=crop at entry=0x1, sliceX=sliceX at entry=0xffffffff,
sliceY=sliceY at entry=0xffffffff, sliceW=sliceW at entry=0xffffffff,
sliceH=sliceH at entry=0xffffffff, printing=printing at entry=0x0,
abortCheckCbk=abortCheckCbk at entry=0x0,
abortCheckCbkData=abortCheckCbkData at entry=0x0, annotDisplayDecideCbk=0x0,
annotDisplayDecideCbkData=annotDisplayDecideCbkData at entry=0x0,
copyXRef=copyXRef at entry=0x0) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/poppler/Page.cc:584
#9  0x00007fffeb31da93 in _poppler_page_render (page=0x605200035180,
cairo=0x604a0000f100, printing=<optimized out>, print_flags=<optimized out>) at
/var/tmp/portage/app-text/poppler-0.24.5/work/poppler-0.24.5/glib/poppler-page.cc:362
#10 0x00007fffeb584ca5 in pdf_page_render_cairo () from
/usr/lib64/zathura/pdf.so
#11 0x000000000042f8b8 in render (page=0x60080002a110, zathura=0x60260000f660)
at render.c:183
#12 render_job (data=0x60080002a110, user_data=0x60260000f660) at render.c:37
#13 0x00007ffff37b2ea6 in ?? () from /usr/lib64/libglib-2.0.so.0
#14 0x00007ffff37b24e5 in ?? () from /usr/lib64/libglib-2.0.so.0
#15 0x00007ffff4e65c08 in __asan::AsanThread::ThreadStart (this=0x7fffe835f000)
at ../../.././libsanitizer/asan/asan_thread.cc:99
#16 0x00007ffff3128f3a in start_thread (arg=0x7fffe835e700) at
pthread_create.c:308
#17 0x00007ffff2b65c3d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:113

--
Antti Husa
Research Assistant, OUSPG

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/poppler-bugs/attachments/20140321/7fbd0e45/attachment-0001.html>