<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Out of bounds memory read when loading zero-bytes PDF"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103552#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Out of bounds memory read when loading zero-bytes PDF"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103552">bug 103552</a>
from <span class="vcard"><a class="email" href="mailto:simon-freedesktop@exyr.org" title="simon-freedesktop@exyr.org">simon-freedesktop@exyr.org</a>
</span></b>
<pre>There is no use case. Passing 0x1 only makes this bug visible with a segfault
but that’s not the point.
NULL probably triggers an explicit check early. Some other pointers might be
preceded by memory that happens to be valid and so reading there silently
"works", but using a -1 error code as an index still causes an out-of-bounds
memory access. I’m not good at creating exploits, but I believe this is
undefined behavior that could potentially lead to a vulnerability.
This bug is not in the glib frontend. It’s in poppler/PDFDoc.cc that the return
value of getStartXRef() is used without checking for errors. In addition to
checking there, another good change might be to assert in makeSubStream that
the 'start' parameter is not negative.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>