qpdf:An infinite loop in libqpdf

Description

QPDF is a command-line program that does structural, content-preserving transformations on PDF files.

An infinite loop was found in libqpdf, which allows attackers to cause a denial of service via a crafted file.

#qpdf $FILE -
==52056== stack-overflow on address 0x7ffc5d511de0 (pc 0x0000005c262c bp 0x7ffc5d512a30 sp 0x7ffc5d511de0 T0)
    #0 0x5c262b in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1497
    #1 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #2 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #3 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #4 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #5 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #6 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #7 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #8 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #9 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #10 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #11 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #12 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #13 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #14 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #15 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #16 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #17 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #18 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #19 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
    #20 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1500:22
    #21 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6
    #22 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #23 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #24 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5
   ......

Affected version: 6.0.0
Fixed version:N/A
Commit fix:N/A
Credit: ADLab of Venustech.
CVE:N/A
Reproducer:
Timeline:
2017-06-04:bug discovered and reported to the qpdf GitHub issue page
2017-07-21:blog post about the issue
Permalink:
https://somevulnsofadlab.blogspot.com/2017/07/qpdfan-infinite-loop-in-libqpdf_26.html

评论

此博客中的热门博文

libming:memory leak in parseSWF_SHAPEWITHSTYLE

libming:memory leak in parseSWF_DOACTION

lrzip:stack buffer overflow in get_fileinfo