<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Out of bounds memory read when loading zero-bytes PDF"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103552#c3">Comment # 3</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Out of bounds memory read when loading zero-bytes PDF"
href="https://bugs.freedesktop.org/show_bug.cgi?id=103552">bug 103552</a>
from <span class="vcard"><a class="email" href="mailto:aacid@kde.org" title="Albert Astals Cid <aacid@kde.org>"> <span class="fn">Albert Astals Cid</span></a>
</span></b>
<pre>(In reply to simon-freedesktop from <a href="show_bug.cgi?id=103552#c2">comment #2</a>)
<span class="quote">> Is “don’t do that” really the best answer to an out-of-bounds memory access
> bug in a library routinely used with untrusted input from the Internet?</span >
Yeah, seriously, it's in your realm of duty to give proper data to the
libraries you use.
<span class="quote">>
> The reason I stumbled upon this bug is that I’d like to use Poppler to test
> a library that generates PDF files. I started writing a test harness before
> I wrote any library code, so the first input I tried with my Rust bindings
> to Poppler was the empty byte vector.
>
> Steps to reproduce: compile with gcc $(pkg-config --cflags --libs
> poppler-glib)
>
> #include "poppler.h"
>
> void main() {
> poppler_document_new_from_data((char*) 1, 0, NULL, NULL);
> }</span >
It works fine if you pass a null pointer in the first parameter, i'll let the
glib frontend maintainers decide if they actually care about your use case or
not</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>