Foxit PDF Reader 1.0.1.0925 – CPDF_DIBSource::TranslateScanline24bpp Out-of-Bounds Read

Exploit Database
107 阅读

作者： Google Security Research

日期： 2016-06-13
类别：
- dos
平台：
- linux
来源：https://www.exploit-db.com/exploits/39941/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=744

We have identified the following crash due to an out-of-bounds read in Foxit PDF Reader (version 1.0.1.0925 for Linux 64-bit), when started with a specially crafted PDF file in the following way:

$ MALLOC_CHECK_=3 DISPLAY=:1 FoxitReader /path/to/poc/file.pdf

The MALLOC_CHECK_=3 environment variable is used to enforce strict checks in the libc memory allocator, while DISPLAY=:1 is set due to the fact that we are testing the application with a virtual X server (Xvfb), but the issue should be equally reproducible with the program started with standard display settings, too.

An example excerpt from the crash log is as follows:

--- cut ---

Program received signal SIGSEGV, Segmentation fault.

0x00000000007fb462 in CPDF_DIBSource::TranslateScanline24bpp(unsigned char*, unsigned char const*) const ()

(gdb) where

#00x00000000007fb462 in CPDF_DIBSource::TranslateScanline24bpp(unsigned char*, unsigned char const*) const

()

#10x00000000007fbd6c in CPDF_DIBSource::GetScanline(int) const ()

#20x000000000084b849 in CFX_DIBSource::Clone(FX_RECT const*) const ()

#30x00000000007f2e71 in CPDF_ImageCache::ContinueGetCachedBitmap() ()

#40x00000000007f2f9e in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) ()

#50x00000000007f3ba0 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) ()

#60x00000000007fb00d in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) ()

#70x00000000007fb13b in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) ()

#80x00000000007f42ff in CPDF_ImageRenderer::StartLoadDIBSource() ()

#90x00000000007f6782 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) ()

#10 0x00000000007f1689 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) ()

#11 0x00000000007f237a in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) ()

#12 0x000000000061d75d in CPDFViewerPageEx::Rendering(CFX_DIBitmap*, int, int, int, int, int, CPDF_RenderOptions*) ()

#13 0x000000000061d9cb in CPDFViewerPageEx::DrawPageContent(CFX_DIBitmap*, CFX_ViewRect&) ()

#14 0x000000000061da6a in CPDFViewerEx::DrawPages(CFX_DIBitmap*) ()

#15 0x000000000061daa8 in CPDFViewerEx::Paint(CFX_DIBitmap*) ()

#16 0x000000000061daf1 in CPDFViewerEx::ContinueRendering() ()

#17 0x000000000061de17 in CPDFViewerEx::GetRenderData(int) ()

#18 0x000000000044b274 in CPDF_TVPreview::paintEvent (this=0x191fca0)

at ../../Readerlite/ReaderLite/src/preview.cpp:1305

#19 0x00007ffff74c2302 in QWidget::event(QEvent*) () from /usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5

#20 0x00007ffff7486c8c in QApplicationPrivate::notify_helper(QObject*, QEvent*) ()