<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" style="display:none;"></style> </head> <body dir="ltr"> <div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr"> <p>><span>podofopdfinfo /var/tmp/Invoice\ -\ NF22394519.pdf</span></p> ><span>Error: An error 8 ocurred during uncompressing the pdf file.</span> <div><br> </div> <div>This is the list for poppler, not podofo.</div> <div><span style="font-size: 12pt;">poppler's pdfinfo can read the file without a problem, and poppler-based tools and ghostscript can both read the file, so the error might be something wrong with podofo.</span><br> </div> <div><span style="font-size: 12pt;">podofoinfo 0.9.1 on my Fedora 25 laptop gets the same error (even on the same line numbers).</span></div> <div>I don't know if encrypting the pdf that way is legitimate, but if you are using podofopdfinfo or any other tool to scan PDFs and a given PDF crashes the tool, it is probably best to consider the PDF malicious.</div> <div>The PDF that you sent is editable, and if you search for /URI, the links are not in ascii/iso/utf8. That could be a sign that they are malicious and someone wanted to make them harder to scan.</div> <div><br> </div> <div>Regards, William</div> <div><br> <br> <div style="color: rgb(0, 0, 0);"> <div> <hr tabindex="-1" style="display:inline-block; width:98%"> <div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> poppler <poppler-bounces@lists.freedesktop.org> on behalf of Alex <mysqlstudent@gmail.com><br> <b>Sent:</b> Wednesday, September 13, 2017 6:20 PM<br> <b>To:</b> poppler@lists.freedesktop.org<br> <b>Subject:</b> [poppler] Encrypted malicious PDFs fails</font> <div> </div> </div> </div> <font size="2"><span style="font-size:10pt;"> <div class="PlainText">Hi,<br> <br> I have a malicious PDF that fails to be detected properly apparently<br> because it's encrypted in some way:<br> <br> # podofopdfinfo /var/tmp/Invoice\ -\ NF22394519.pdf<br> Error: An error 8 ocurred during uncompressing the pdf file.<br> <br> <br> PoDoFo encounter an error. Error: 8 ePdfError_InternalLogic<br> Error Description: An internal error occurred.<br> Callstack:<br> #0 Error Source:<br> /builddir/build/BUILD/podofo-0.9.1/src/base/PdfParser.cpp:209<br> Information: Unable to load objects from file.<br> #1 Error Source:<br> /builddir/build/BUILD/podofo-0.9.1/src/base/PdfParserObject.cpp:377<br> Information: Unable to parse the stream for object 30 0 obj .<br> #2 Error Source:<br> /builddir/build/BUILD/podofo-0.9.1/src/base/PdfEncrypt.cpp:1137<br> Information: CreateEncryptionInputStream does not yet<br> support AES<br> <br> Would someone be interested in investigating this? Am I missing<br> something to properly detect and manage these?<br> <br> <a href="https://www.dropbox.com/s/8bqkp5okojma83b/Invoice%20-%20NF22394519.pdf?dl=0" id="LPlnk317866" previewremoved="true">https://www.dropbox.com/s/8bqkp5okojma83b/Invoice%20-%20NF22394519.pdf?dl=0</a><br> <br> <br> Is there a legitimate reason to encrypt a PDF in this way? In other<br> words, I can still see the contents and click on the malicious link,<br> but apparently not view the meta information about it...<br> _______________________________________________<br> poppler mailing list<br> poppler@lists.freedesktop.org<br> <a href="https://lists.freedesktop.org/mailman/listinfo/poppler" id="LPlnk518830" previewremoved="true">https://lists.freedesktop.org/mailman/listinfo/poppler</a> <div id="LPBorder_GT_15053604784810.7892664119426216" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;"> <table id="LPContainer_15053604784780.4717603625221405" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);"> <tbody> <tr valign="top" style="border-spacing: 0px;"> <td id="TextCell_15053604784790.06695543240236446" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;"> <div id="LPRemovePreviewContainer_15053604784790.5708421513076147"></div> <div id="LPTitle_15053604784790.04468019002553181" style="top: 0px; color: rgb(0, 120, 215); font-weight: normal; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;"> <a id="LPUrlAnchor_15053604784800.8743596875533166" href="https://lists.freedesktop.org/mailman/listinfo/poppler" target="_blank" style="text-decoration: none;">poppler Info Page - freedesktop.org</a></div> <div id="LPMetadata_15053604784800.03641844378954495" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;"> lists.freedesktop.org</div> <div id="LPDescription_15053604784800.302838668342704" style="display: block; color: rgb(102, 102, 102); font-weight: normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;"> Subscribing to poppler: Subscribe to poppler by filling out the following form. Use of all freedesktop.org lists is subject to our Code of ...</div> </td> </tr> </tbody> </table> </div> <br> <br> </div> </span></font></div> </div> </div> </body> </html>