<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [pdfunite] crash when parsing a crafted pdf due to null pointer deference in ~/utils/pdfunite.cc:276"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101153">101153</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[pdfunite] crash when parsing a crafted pdf due to null pointer deference in ~/utils/pdfunite.cc:276
</td>
</tr>
<tr>
<th>Product</th>
<td>poppler
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>OS</th>
<td>FreeBSD
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>utils
</td>
</tr>
<tr>
<th>Assignee</th>
<td>poppler-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>pengjiaqi@iie.ac.cn
</td>
</tr></table>
<p>
<div>
<pre>## Summary
pdfunite util in poppler-0.55.0 will crash when parsing a crafted pdf file due
to null pointer deference in main()@~/utils/pdfunite.cc:276
ps: this issue is similar to
<a class="bz_bug_link
bz_status_NEW "
title="NEW - [pdfunite] crash when parsing a crafted pdf due to null pointer deference"
href="show_bug.cgi?id=101149">https://bugs.freedesktop.org/show_bug.cgi?id=101149</a>, but crashes in different
location and needs a different patch.
## Reprocude
openstack@openstack-virtual-machine:~/pjq/poppler-0.55.0/build-gcc/utils$
./pdfunite null_pointer_deference_poc_276.pdf 1.pdf
Internal Error: xref num 17 not found but needed, try to reconstruct<0a>
Syntax Error: Kid object (page 1) is wrong type (null)
Segmentation fault
## Crash Stack
Program received signal SIGSEGV, Segmentation fault.
0x000000000041acbb in main (argc=3, argv=<optimized out>) at
../../utils/pdfunite.cc:276
276 docs[0]->markPageObjects(ocObj.getDict(), yRef, countRef, 0,
refPage->num, refPage->num);
(gdb) bt
#0 0x000000000041acbb in main (argc=3, argv=<optimized out>) at
../../utils/pdfunite.cc:276
## Analysis
in ~/utils/pdfunite.cc:276
270 Ref *refPage = docs[0]->getCatalog()->getPageRef(1);
271 if (!afObj.isNull()) {
272 docs[0]->markAcroForm(&afObj, yRef, countRef, 0, refPage->num,
refPage->num);
273 }
274 catDict->lookupNF("OCProperties", &ocObj);
275 if (!ocObj.isNull() && ocObj.isDict()) {
276 docs[0]->markPageObjects(ocObj.getDict(), yRef, countRef, 0,
refPage->num, refPage->num);
277 }
(gdb) p refPage
$1 = (Ref *) 0x0
Here, the last two arguments of markPageObjects() are both refPage->num;
but refPage=0, causing null pointer deference.
refPage comes from line 270 by docs[0]->getCatalog()->getPageRef(1);
but function Catalog::getPageRef() may return NULL (as below):
in ~/poppler/Catalog.cc:257
249 Ref *Catalog::getPageRef(int i)
250 {
251 if (i < 1) return NULL;
252
253 catalogLocker();
254 if (i > lastCachedPage) {
255 GBool cached = cachePageTree(i);
256 if ( cached == gFalse) {
257 return NULL;
258 }
259 }
260 return &pageRefs[i-1];
261 }
## Patch
In ~/utils/pdfunite.cc, before refPage->num, first check the value refPage in
line270 is zero or not.
## Author
name: Jiaqi Peng
email: <a href="mailto:pjqruc@gmail.com">pjqruc@gmail.com</a> (if you need poc, contact me via email)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>