qpdf:An infinite loop in libqpdf

Description

QPDF is a command-line program that does structural, content-preserving transformations on PDF files.

An infinite loop was found in libqpdf, which allows attackers to cause a denial of service via a crafted file.

#qpdf $FILE -
==40517== stack-overflow on address 0x7ffd3e389d38 (pc 0x00000046b469 bp 0x7ffd3e38a5c0 sp 0x7ffd3e389d40 T0)
    #0 0x46b468 in memmove /home/haojun/Downloads/llvm-clang/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:679
    #1 0x7f866291704d  /usr/include/bits/string3.h:57
    #2 0x7f866291704d  pcre_compile.c:3918
    #3 0x7f866291704d  pcre_compile.c:7273
    #4 0x7f8662916e25  pcre_compile.c:6635
    #5 0x7f8662916e25  pcre_compile.c:7273
    #6 0x7f8662916e25  pcre_compile.c:6635
    #7 0x7f8662916e25  pcre_compile.c:7273
    #8 0x7f866291c5c5 in pcre_compile2 pcre_compile.c:8131
    #9 0x8adacb in PCRE::PCRE(char const*, int) /home/haojun/Downloads/qpdf-master/libqpdf/PCRE.cc:144:18
    #10 0x67d604 in QPDFTokenizer::resolveLiteral() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFTokenizer.cc:62:10
    #11 0x6835cb in QPDFTokenizer::presentCharacter(char) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFTokenizer.cc:432:9
    #12 0x688d3f in QPDFTokenizer::readToken(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFTokenizer.cc:519:6
    #13 0x645545 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:873:23
    #14 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #15 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #16 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #17 0x63b73a in QPDFObjectHandle::parse(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:841:12
    #18 0x58a10c in QPDF::readObject(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1017:31
    #19 0x5a5fee in QPDF::readObjectAtOffset(bool, long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, int&, int&) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1393:27
    #20 0x5c104e in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1474:7
    #21 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #22 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #23 0x64f57d in QPDFObjectHandle::isName() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:184:5
    #24 0x64f57d in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1074
    #25 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #26 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #27 0x63b73a in QPDFObjectHandle::parse(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:841:12
    #28 0x58a10c in QPDF::readObject(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1017:31
    #29 0x5a5fee in QPDF::readObjectAtOffset(bool, long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, int&, int&) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1393:27
    #30 0x5c104e in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1474:7
    #31 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19
    #32 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520
    #33 0x64f57d in QPDFObjectHandle::isName() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:184:5
    #34 0x64f57d in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1074
    #35 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #36 0x646a79 in QPDFObjectHandle::parseInternal(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*, bool, bool, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:939:15
    #37 0x63b73a in QPDFObjectHandle::parse(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, QPDFTokenizer&, bool&, QPDFObjectHandle::StringDecrypter*, QPDF*) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:841:12
    #38 0x58a10c in QPDF::readObject(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, bool) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1017:31
    #39 0x5a5fee in QPDF::readObjectAtOffset(bool, long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, int, int, int&, int&) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1393:27
    ......

Affected version: 6.0.0
Fixed version:N/A
Commit fix:N/A
Credit: ADLab of Venustech.
CVE:N/A
Reproducer:
Timeline:
2017-06-04:bug discovered and reported to the qpdf GitHub issue page
2017-07-21:blog post about the issue
Permalink:
https://somevulnsofadlab.blogspot.com/2017/07/qpdfan-infinite-loop-in-libqpdf_65.html

评论

发表评论

此博客中的热门博文

qpdf:An infinite loop in libqpdf

Description QPDF  is a command-line program that does structural, content-preserving transformations on PDF files. An infinite loop was found in libqpdf, which allows attackers to cause a denial of service via a crafted file. #qpdf $FILE - ==52056== stack-overflow on address 0x7ffc5d511de0 (pc 0x0000005c262c bp 0x7ffc5d512a30 sp 0x7ffc5d511de0 T0) #0 0x5c262b in QPDF::resolveObjectsInStream(int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1497 #1 0x5c13b6 in QPDF::resolve(int, int) /home/haojun/Downloads/qpdf-master/libqpdf/QPDF.cc:1480:6 #2 0x61e6c1 in QPDF::Resolver::resolve(QPDF*, int, int) /home/haojun/Downloads/qpdf-master/include/qpdf/QPDF.hh:520:19 #3 0x61e6c1 in QPDFObjectHandle::dereference() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:1520 #4 0x621e00 in QPDFObjectHandle::isStream() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFObjectHandle.cc:226:5 #5 0x5c27ce in QPDF::resolveObjectsInStream(int) /home/haojun/Downl
阅读全文

qpdf:An infinite loop in libqpdf

Description QPDF  is a command-line program that does structural, content-preserving transformations on PDF files. An infinite loop was found in libqpdf, which allows attackers to cause a denial of service via a crafted file. #qpdf $FILE - ==10354== stack-overflow on address 0x7fffdaf46ef8 (pc 0x7fc995a7f020 bp 0x000000935760 sp 0x7fffdaf46e50 T0) #0 0x7fc995a7f01f in pcre_compile2 pcre_compile.c:7903 #1 0x8adacb in PCRE::PCRE(char const*, int) /home/haojun/Downloads/qpdf-master/libqpdf/PCRE.cc:144:18 #2 0x67d604 in QPDFTokenizer::resolveLiteral() /home/haojun/Downloads/qpdf-master/libqpdf/QPDFTokenizer.cc:62:10 #3 0x6835cb in QPDFTokenizer::presentCharacter(char) /home/haojun/Downloads/qpdf-master/libqpdf/QPDFTokenizer.cc:432:9 #4 0x688d3f in QPDFTokenizer::readToken(PointerHolder<InputSource>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/haojun/Downloads/qpdf-master/libqpdf/QP
阅读全文