<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Integer overflow leading to heap overflow in JBIG2Stream.cc, CVE-2017-9776"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101541">101541</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Integer overflow leading to heap overflow in JBIG2Stream.cc, CVE-2017-9776
</td>
</tr>
<tr>
<th>Product</th>
<td>poppler
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>general
</td>
</tr>
<tr>
<th>Assignee</th>
<td>poppler-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>foca@salesforce.com
</td>
</tr></table>
<p>
<div>
<pre>This vulnerability has been reported privately. Albert Astals Cid already fixed
it in the following commit:
<a href="https://cgit.freedesktop.org/poppler/poppler/commit/?id=a3a98a6d83dfbf49f565f5aa2d7c07153a7f62fc">https://cgit.freedesktop.org/poppler/poppler/commit/?id=a3a98a6d83dfbf49f565f5aa2d7c07153a7f62fc</a>
The CVE-2017-9775 has been assigned to this vulnerability.
The vulnerability is due of an integer overflow in the file JBIG2Stream.cc:895
at the function JBIG2Bitmap::combine:
894 for (yy = y0; yy < y1; ++yy) {
895 if (unlikely(y + yy) >= h)
896 continue;
897
898 // one byte per line -- need to mask both left and right side
899 if (oneByte) {
900 if (x >= 0) {
901 destPtr = data + (y + yy) * line + (x >> 3);
902 srcPtr = bitmap->data + yy * bitmap->line;
903 dest = *destPtr;
904 src1 = *srcPtr;
The user controls the variables y, line and x. During the addition y + yy an
integer overflow could happens if the user uses a very high values for y , for
example 0x7ffffff.
The code is checking for overflows with the code at the beggining of the loop:
895 if (unlikely(y + yy) >= h)
896 continue;
But when the integer overflow happens this check is bypassed and it's possible
to overflow the data variable in line 901. The variable data is in the heap.
The vulnerability leads to a heap overflow vulnerability. The different samples
corrupt the heap in different ways. Some of then finish in a double free, other
in an error calling malloc and free.
The file JBIG2Stream.cc_903_smallest_possible.pdf contains the minimum data to
trigger the bug.
This bug could be used by an attacker to control the heap.
This vulnerability has been found by Offensive Research at Salesforce.com:
Alberto Garcia (@algillera), Francisco Oca (@francisco_oca) & Suleman Ali
(@Salbei_)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>