qpdf:An infinite loop in libqpdf

Description

QPDF is a command-line program that does structural, content-preserving transformations on PDF files.

An infinite loop was found in libqpdf, which allows attackers to cause a denial of service via a crafted file.

#qpdf $FILE -
==29487== stack-overflow on address 0x7fff5e6b1e38 (pc 0x0000005187d2 bp 0x7fff5e6b2680 sp 0x7fff5e6b1e10 T0)
    #0 0x5187d1 in operator new(unsigned long) /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:82
    #1 0x65e604 in PointerHolder<QPDFObject>::PointerHolder(QPDFObject*, bool) /home/haojun/Downloads/qpdf-master/include/qpdf/PointerHolder.hh:75:17
    #2 0x65e604 in QPDFObjectHandle::QPDFObjectHandle(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:45
    #3 0x65e604 in QPDFObjectHandle::newIndirect(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1093
    #4 0x5c27bf in QPDFObjectHandle::Factory::newIndirect(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDFObjectHandle.hh:518:13
    #5 0x5c27bf in QPDF::getObjectByID(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1625
    #6 0x5c27bf in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1499
    #7 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #8 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #9 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #10 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #11 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #12 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #13 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #14 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #15 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #16 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #17 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #18 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #19 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #20 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    ......

Affected version: 6.0.0
Fixed version:N/A
Commit fix:N/A
Credit: ADLab of Venustech.
CVE:N/A
Reproducer:
Timeline:
2017-06-04:bug discovered and reported to the qpdf GitHub issue page
2017-07-21:blog post about the issue
Permalink:
https://somevulnsofadlab.blogspot.com/2017/07/qpdfan-infinite-loop-in-libqpdf_21.html

评论

此博客中的热门博文

lrzip:stack buffer overflow in get_fileinfo

Poppler:stack buffer overflow in GfxImageColorMap::getGray

libming:memory leak in parseSWF_DOACTION