Skip to content

Segmentation Fault (stack exhaustion) on a crafted PDF file #202

Closed
@pushdword

Description

@pushdword

A crafted pdf file causes a segmentation fault, stack-overflow reported by LLVM ASan - but it seems stack exhaustion, causing a denial of service and there is a chance of code execution.
qpdflibsegfault.zip
Details are attached inside the zip called 'gdb log'.
I have tested with libqpdf and qpdf itself, debugged and used LLVM ASan to identify the possible root cause.
A pdf POC is inside the zip.
Versions tested: 6.0.0 and 8.0.2.
c code to test:

QPDF pdf;
pdf.processFile("crafted pdf.pdf"); //segmentation fault here.

running:

== simple source code using libqpdf ==
$ cat openpdf.cc
#include
#include <string.h>
#include <stdlib.h>
#include <qpdf/QPDF.hh>
#include <qpdf/QUtil.hh>
#include <stdint.h>

int main(void)
{
int pageno = 2;
try
{
QPDF pdf;
pdf.processFile("fuzzed.pdf");
std::vector pages = pdf.getAllPages();
if ((pageno < 1) || (static_cast<size_t>(pageno) > pages.size()))
{
exit(1);
}
}
catch (std::exception& e)
{
return 0;
}
return 0;
}
$ clang++-6.0 -L/usr/local/lib -lz -ljpeg -lqpdf -lpthread *.cc -g -o openpdf
$ ./openpdf
WARNING: fuzzed.pdf (trailer, offset 191702): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191700): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191698): expected dictionary key but found non-name object; inserting key /QPDFFake1
(...)
WARNING: fuzzed.pdf (trailer, offset 328678): unknown token while reading object; treating as string
WARNING: fuzzed.pdf (trailer, offset 328700): unexpected EOF
WARNING: fuzzed.pdf (trailer, offset 328700): parse error while reading object
Segmentation fault (core dumped)

Testing qpdf 6.0.0:

[pushdword@localhost qpdflib]$ qpdf fuzzedpdf.pdf test.pdf
Segmentation fault (core dumped)
[pushdword@localhost qpdflib]$ qpdf --version
qpdf version 6.0.0
Copyright (c) 2005-2015 Jay Berkenbilt
This software may be distributed under the terms of version 2 of the
Artistic License which may be found in the source distribution. It is
provided "as is" without express or implied warranty.

testing qpdf 8.0.2

$ qpdf fuzzed.pdf test.pdf
WARNING: fuzzed.pdf (trailer, offset 191702): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191700): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191698): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191696): expected dictionary key but found non-name object; inserting key /QPDFFake1
(... a very long warning repetition ...)
WARNING: fuzzed.pdf (trailer, offset 54774): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 328678): unknown token while reading object; treating as string
WARNING: fuzzed.pdf (trailer, offset 328700): unexpected EOF
WARNING: fuzzed.pdf (trailer, offset 328700): parse error while reading object
Segmentation fault (core dumped)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions