GitLab

pdfdetch

desciption

funtion abort() in library， will lead to denial of service.

version

The latest stable release poppler-0.71.0, released on Oct 31, 2018

others

this bug is reported by pwd@360TeamSeri0us, please send email to teamSeri0us360@gmail.com if you have any questions.

a reachable abort at Object.h:403

Test Target

$ ./pdfdetch --save 1 poc
Internal Error (0): Call to Object where the object was type 7, not the expected type 8
Aborted (core dumped)

debug info

#define OBJECT_TYPE_CHECK(wanted_type) \
    if (unlikely(type != wanted_type)) { \
        error(errInternal, 0, "Call to Object where the object was type {0:d}, " \
                 "not the expected type {1:d}", type, wanted_type); \
        abort(); \
    }

abort_Object.h_403