<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Invalid memory read in Page::getCropBox() - Page.h:155"
href="https://bugs.freedesktop.org/show_bug.cgi?id=100981">100981</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Invalid memory read in Page::getCropBox() - Page.h:155
</td>
</tr>
<tr>
<th>Product</th>
<td>poppler
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Assignee</th>
<td>poppler-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>martino.sani@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=131286" name="attach_131286" title="testcase.pdf">attachment 131286</a> <a href="attachment.cgi?id=131286&action=edit" title="testcase.pdf">[details]</a></span>
testcase.pdf
Attached testcase lead to an invalid memory read in Page::getCropBox() -
Page.h:155.
Steps to reproduce:
1) CC=clang CXX=clang++ CFLAGS="-O0 -g -ggdb" CXXFLAGS="-O0 -g -ggdb"
LDFLAGS="-lpthread" ./configure --disable-poppler-qt4 --disable-poppler-qt5
--enable-xpdf-headers --enable-static --disable-shared ; make
2) cd cpp ; CC=clang CXX=clang++ CFLAGS="-O0 -g -ggdb" CXXFLAGS="-O0 -g -ggdb"
make
3) ./cpp/tests/poppler-dump --show-pages testcase.pdf
GDB info:
Program received signal SIGSEGV, Segmentation fault.
Page::getCropBox (this=0x0) at ../poppler/Page.h:155
155 PDFRectangle *getCropBox() { return attrs->getCropBox(); }
(gdb) bt
#0 Page::getCropBox (this=0x0) at ../poppler/Page.h:155
#1 0x0000000000418c01 in poppler::page::page_rect (this=0x83a5d0,
box=poppler::crop_box) at poppler-page.cpp:132
#2 0x00000000004089a4 in print_page (p=0x83a5d0) at poppler-dump.cpp:303
#3 0x00000000004071f8 in main (argc=2, argv=0x7fffffffe428) at
poppler-dump.cpp:380
(gdb) disas $rip
Dump of assembler code for function Page::getCropBox():
0x0000000000419660 <+0>: push rbp
0x0000000000419661 <+1>: mov rbp,rsp
0x0000000000419664 <+4>: sub rsp,0x10
0x0000000000419668 <+8>: mov QWORD PTR [rbp-0x8],rdi
0x000000000041966c <+12>: mov rdi,QWORD PTR [rbp-0x8]
=> 0x0000000000419670 <+16>: mov rdi,QWORD PTR [rdi+0x30]
0x0000000000419674 <+20>: call 0x419a90 <PageAttrs::getCropBox()>
(gdb) print $rdi
$1 = 0
Poppler version:
poppler-0.54.0
Test platform:
Linux 4.3.0-1-amd64 #1 SMP Debian 4.3.3-7 (2016-01-19) x86_64 GNU/Linux</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>