<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Stack buffer overflow in GfxState.cc:4066, CVE-2017-9775"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101540">101540</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Stack buffer overflow in GfxState.cc:4066, CVE-2017-9775
</td>
</tr>
<tr>
<th>Product</th>
<td>poppler
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Assignee</th>
<td>poppler-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>foca@salesforce.com
</td>
</tr></table>
<p>
<div>
<pre>This vulnerability has been reported privately. Albert Astals Cid already fixed
it in the following commit:
<a href="https://cgit.freedesktop.org/poppler/poppler/commit/?id=8f4ff8243a3d599ff2a6c08b1da389e606ba4fc9">https://cgit.freedesktop.org/poppler/poppler/commit/?id=8f4ff8243a3d599ff2a6c08b1da389e606ba4fc9</a>
The CVE-2017-9775 has been assigned to this vulnerability.
There is a stack based overflow. The vulnerability is in GfxState.cc:4066.
4065 for (i = 0; i < nComps; ++i) {
4066 out[i] = 0;
4067 }
The variable out is a stack variable with a defined size of 32 items:
#define gfxColorMaxComps funcMaxOutputs
...
#define funcMaxOutputs 32
This variable out is defined at the beginning of the getColor function:
4035 void GfxUnivariateShading::getColor(double t, GfxColor *color) {
4036 double out[gfxColorMaxComps];
4037 int i, nComps;
4038
4039 // NB: there can be one function with n outputs or n functions with
4040 // one output each (where n = number of color components)
4041 nComps = nFuncs * funcs[0]->getOutputSize();
nComps is user controllable (in the PoC has the value 42), and it is used to
write into the variable out at GfxState.cc:4066.
4065 for (i = 0; i < nComps; ++i) {
4066 out[i] = 0;
4067 }
Parsing the file PoC.pdf 10 bytes of the stack are overwritten with 00.
Due to some restrictions in the lines after the bug, an attacker can't control
the values written in the stack so it unlikely this could lead to a code
execution.
A solution could be:
4065 for (i = 0; i < nComps && i < gfxColorMaxComps; ++i) {
This vulnerability has been found by Offensive Research at Salesforce.com:
Alberto Garcia (@algillera), Francisco Oca (@francisco_oca) & Suleman Ali
(@Salbei_)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>