Description
A crafted pdf file causes a segmentation fault, stack-overflow reported by LLVM ASan - but it seems stack exhaustion, causing a denial of service and there is a chance of code execution.
qpdflibsegfault.zip
Details are attached inside the zip called 'gdb log'.
I have tested with libqpdf and qpdf itself, debugged and used LLVM ASan to identify the possible root cause.
A pdf POC is inside the zip.
Versions tested: 6.0.0 and 8.0.2.
c code to test:
QPDF pdf;
pdf.processFile("crafted pdf.pdf"); //segmentation fault here.
running:
== simple source code using libqpdf ==
$ cat openpdf.cc
#include
#include <string.h>
#include <stdlib.h>
#include <qpdf/QPDF.hh>
#include <qpdf/QUtil.hh>
#include <stdint.h>int main(void)
{
int pageno = 2;
try
{
QPDF pdf;
pdf.processFile("fuzzed.pdf");
std::vector pages = pdf.getAllPages();
if ((pageno < 1) || (static_cast<size_t>(pageno) > pages.size()))
{
exit(1);
}
}
catch (std::exception& e)
{
return 0;
}
return 0;
}
$ clang++-6.0 -L/usr/local/lib -lz -ljpeg -lqpdf -lpthread *.cc -g -o openpdf
$ ./openpdf
WARNING: fuzzed.pdf (trailer, offset 191702): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191700): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191698): expected dictionary key but found non-name object; inserting key /QPDFFake1
(...)
WARNING: fuzzed.pdf (trailer, offset 328678): unknown token while reading object; treating as string
WARNING: fuzzed.pdf (trailer, offset 328700): unexpected EOF
WARNING: fuzzed.pdf (trailer, offset 328700): parse error while reading object
Segmentation fault (core dumped)
Testing qpdf 6.0.0:
[pushdword@localhost qpdflib]$ qpdf fuzzedpdf.pdf test.pdf
Segmentation fault (core dumped)
[pushdword@localhost qpdflib]$ qpdf --version
qpdf version 6.0.0
Copyright (c) 2005-2015 Jay Berkenbilt
This software may be distributed under the terms of version 2 of the
Artistic License which may be found in the source distribution. It is
provided "as is" without express or implied warranty.
testing qpdf 8.0.2
$ qpdf fuzzed.pdf test.pdf
WARNING: fuzzed.pdf (trailer, offset 191702): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191700): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191698): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 191696): expected dictionary key but found non-name object; inserting key /QPDFFake1
(... a very long warning repetition ...)
WARNING: fuzzed.pdf (trailer, offset 54774): expected dictionary key but found non-name object; inserting key /QPDFFake1
WARNING: fuzzed.pdf (trailer, offset 328678): unknown token while reading object; treating as string
WARNING: fuzzed.pdf (trailer, offset 328700): unexpected EOF
WARNING: fuzzed.pdf (trailer, offset 328700): parse error while reading object
Segmentation fault (core dumped)