[Poppler-bugs] [Bug 102719] New: Floating point exception vulnerability in poppler 0.59.0 Splash::scaleImageYuXd()

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=102719

            Bug ID: 102719
           Summary: Floating point exception vulnerability in poppler
                    0.59.0 Splash::scaleImageYuXd()
           Product: poppler
           Version: unspecified
          Hardware: All
                OS: Linux (All)
            Status: NEW
          Severity: major
          Priority: medium
         Component: general
          Assignee: poppler-bugs at lists.freedesktop.org
          Reporter: etovio at gmail.com

Created attachment 134210
  --> https://bugs.freedesktop.org/attachment.cgi?id=134210&action=edit
POC file of the vulnerability

A floating point exception vulnerability was found in poppler 0.59.0 Splash.cc
Splash::scaleImageYuXd which may lead to potential attack when handling
malicious PDF files:

gzq at ubuntu:~/work/vul/poppler$ /home/gzq/install/poppler-dev/bin/pdftohtml -q
-s mal-Splash-cc-4585-3-67-SIGFPE.pdf a
Floating point exception
gzq at ubuntu:~/work/vul/poppler$ gdb -q
/home/gzq/install/poppler-dev/bin/pdftohtml
Reading symbols from /home/gzq/install/poppler-dev/bin/pdftohtml...done.
(gdb) r -q -s mal-Splash-cc-4585-3-67-SIGFPE.pdf a
Starting program: /home/gzq/install/poppler-dev/bin/pdftohtml -q -s
mal-Splash-cc-4585-3-67-SIGFPE.pdf a
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGFPE, Arithmetic exception.
0x0000000000648f31 in Splash::scaleImageYuXd (this=<optimized out>,
src=0x429700 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned
char*)>, srcData=0x7fffffffd270, srcMode=splashModeMono8, nComps=1,
srcAlpha=false, srcWidth=10, srcHeight=<optimized out>, 
    scaledWidth=<optimized out>, scaledHeight=3, dest=0xa) at Splash.cc:4585
4585      yq = scaledHeight % srcHeight;
(gdb) bt
#0  0x0000000000648f31 in Splash::scaleImageYuXd (this=<optimized out>,
src=0x429700 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned
char*)>, srcData=0x7fffffffd270, srcMode=splashModeMono8, nComps=1,
srcAlpha=false, srcWidth=10, srcHeight=<optimized out>, 
    scaledWidth=<optimized out>, scaledHeight=3, dest=0xa) at Splash.cc:4585
#1  0x000000000063e551 in Splash::scaleImage (this=<optimized out>,
src=<optimized out>, srcData=<optimized out>, srcMode=<optimized out>,
nComps=<optimized out>, srcAlpha=<optimized out>, srcWidth=10,
srcHeight=<optimized out>, scaledWidth=2, scaledHeight=3, 
    interpolate=2, tilingPattern=2) at Splash.cc:4166
#2  0x000000000063da14 in Splash::drawImage (this=<optimized out>,
src=<optimized out>, tf=<optimized out>, srcData=<optimized out>,
srcMode=<optimized out>, srcAlpha=<optimized out>, w=<optimized out>,
h=<optimized out>, mat=<optimized out>, 
    interpolate=<optimized out>, tilingPattern=<optimized out>) at
Splash.cc:3760
#3  0x000000000042fce4 in SplashOutputDev::drawSoftMaskedImage (this=<optimized
out>, state=<optimized out>, ref=<optimized out>, str=<optimized out>,
width=<optimized out>, height=<optimized out>, colorMap=<optimized out>,
interpolate=<optimized out>, 
    maskStr=<optimized out>, maskWidth=<optimized out>, maskHeight=<optimized
out>, maskColorMap=<optimized out>, maskInterpolate=<optimized out>) at
SplashOutputDev.cc:4054
#4  0x00000000004d36e3 in Gfx::doImage (this=<optimized out>, ref=<optimized
out>, str=<optimized out>, inlineImg=<optimized out>) at Gfx.cc:4553
#5  0x00000000004a6700 in Gfx::opXObject (this=0x9e4120, args=<optimized out>,
numArgs=<optimized out>) at Gfx.cc:4130
#6  0x00000000004bf976 in Gfx::execOp (this=<optimized out>, cmd=<optimized
out>, args=<optimized out>, numArgs=<optimized out>) at Gfx.cc:880
#7  0x00000000004be5f1 in Gfx::go (this=<optimized out>, topLevel=<optimized
out>) at Gfx.cc:744
#8  0x00000000004bde55 in Gfx::display (this=<optimized out>, obj=<optimized
out>, topLevel=<optimized out>) at Gfx.cc:706
#9  0x0000000000567465 in Page::displaySlice (this=0x9e2e70, out=0x9e3750,
hDPI=<optimized out>, vDPI=<optimized out>, rotate=<optimized out>,
useMediaBox=<optimized out>, crop=<optimized out>, sliceX=<optimized out>,
sliceY=<optimized out>, sliceW=<optimized out>, 
    sliceH=<optimized out>, printing=<optimized out>, abortCheckCbk=<optimized
out>, abortCheckCbkData=<optimized out>, annotDisplayDecideCbk=<optimized out>,
annotDisplayDecideCbkData=<optimized out>, copyXRef=<optimized out>) at
Page.cc:560
#10 0x000000000056719e in Page::display (this=0x0, out=0x429700
<SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>,
hDPI=917.99900000000002, vDPI=1187.999, rotate=0, useMediaBox=true, crop=false,
printing=false, abortCheckCbk=0x0, 
    abortCheckCbkData=0x0, annotDisplayDecideCbk=0x0,
annotDisplayDecideCbkData=0x0, copyXRef=<optimized out>) at Page.cc:481
#11 0x000000000056f0d0 in PDFDoc::displayPage (this=0x9dfe70, out=0x9e3750,
page=1, hDPI=<optimized out>, vDPI=<optimized out>, rotate=<optimized out>,
useMediaBox=true, crop=<optimized out>, printing=<optimized out>,
abortCheckCbk=<optimized out>, 
    abortCheckCbkData=<optimized out>, annotDisplayDecideCbk=<optimized out>,
annotDisplayDecideCbkData=<optimized out>, copyXRef=false) at PDFDoc.cc:485
#12 0x00000000004085cf in main (argc=<optimized out>, argv=<optimized out>) at
pdftohtml.cc:408
(gdb)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/poppler-bugs/attachments/20170914/2f2addea/attachment.html>