[Poppler-bugs] [Bug 86854] New: Segfault / invalid read in GooString::GooString / PSOutputDev::setupFont when using pdftops

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=86854

            Bug ID: 86854
           Summary: Segfault / invalid read in GooString::GooString /
                    PSOutputDev::setupFont when using pdftops
           Product: poppler
           Version: unspecified
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: general
          Assignee: poppler-bugs at lists.freedesktop.org
          Reporter: hanno at hboeck.de

Created attachment 110231
  --> https://bugs.freedesktop.org/attachment.cgi?id=110231&action=edit
fuzzed pdf crashing pdftops

The attached file will cause a segfault when running through pdftops (latest
poppler version, 2.18.1).

valgrind output:
==12858== Invalid read of size 4
==12858==    at 0x4EF2557: GooString::GooString(GooString const*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBCEF5: PSOutputDev::setupFont(GfxFont*, Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBD2DE: PSOutputDev::setupFonts(Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBBA46: PSOutputDev::setupResources(Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBC05C: PSOutputDev::writeDocSetup(PDFDoc*, Catalog*, int,
int, bool) (in /usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBD8AA: PSOutputDev::init(void (*)(void*, char const*, int),
void*, PSFileType, char*, PDFDoc*, int, int, PSOutMode, int, int, int, int,
bool, int, int, bool, bool) (in /usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x401EC0: main (in /usr/bin/pdftops)
==12858==  Address 0x18 is not stack'd, malloc'd or (recently) free'd
==12858== 
==12858== 
==12858== Process terminating with default action of signal 11 (SIGSEGV)
==12858==  Access not within mapped region at address 0x18
==12858==    at 0x4EF2557: GooString::GooString(GooString const*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBCEF5: PSOutputDev::setupFont(GfxFont*, Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBD2DE: PSOutputDev::setupFonts(Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBBA46: PSOutputDev::setupResources(Dict*) (in
/usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBC05C: PSOutputDev::writeDocSetup(PDFDoc*, Catalog*, int,
int, bool) (in /usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x4FBD8AA: PSOutputDev::init(void (*)(void*, char const*, int),
void*, PSFileType, char*, PDFDoc*, int, int, PSOutMode, int, int, int, int,
bool, int, int, bool, bool) (in /usr/lib64/libpoppler.so.47.0.0)
==12858==    by 0x401EC0: main (in /usr/bin/pdftops)
==12858==  If you believe this happened as a result of a stack
==12858==  overflow in your program's main thread (unlikely but
==12858==  possible), you can try to increase the size of the
==12858==  main thread stack using the --main-stacksize= flag.
==12858==  The main thread stack size used in this run was 8388608.


Address Sanitizer output:
=================================================================
==12859==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc
0x00000054dcfc sp 0x7fff79476f00 bp 0x60400001c2d0 T0)
    #0 0x54dcfb in GooString::GooString(GooString const*)
/tmp/poppler-0.28.1/goo/GooString.cc:240
    #1 0x52ebc0 in GooString::copy() const ../goo/GooString.h:75
    #2 0x52ebc0 in PSOutputDev::setupFont(GfxFont*, Dict*)
/tmp/poppler-0.28.1/poppler/PSOutputDev.cc:1882
    #3 0x53043d in PSOutputDev::setupFonts(Dict*)
/tmp/poppler-0.28.1/poppler/PSOutputDev.cc:1831
    #4 0x51fc4a in PSOutputDev::setupResources(Dict*)
/tmp/poppler-0.28.1/poppler/PSOutputDev.cc:1734
    #5 0x5222b1 in PSOutputDev::writeDocSetup(PDFDoc*, Catalog*, int, int,
bool) /tmp/poppler-0.28.1/poppler/PSOutputDev.cc:1629
    #6 0x525a89 in PSOutputDev::init(void (*)(void*, char const*, int), void*,
PSFileType, char*, PDFDoc*, int, int, PSOutMode, int, int, int, int, bool, int,
int, bool, bool) /tmp/poppler-0.28.1/poppler/PSOutputDev.cc:1390
    #7 0x40d9b0 in main /tmp/poppler-0.28.1/utils/pdftops.cc:409
    #8 0x7f6da8758f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
    #9 0x413fd3 (/tmp/poppler-0.28.1/utils/pdftops+0x413fd3)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/poppler-0.28.1/goo/GooString.cc:240
GooString::GooString(GooString const*)

This was found with the tool american fuzzy lop.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/poppler-bugs/attachments/20141129/948f62d6/attachment.html>