Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • P poppler
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 665
    • Issues 665
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 46
    • Merge requests 46
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • poppler
  • poppler
  • Issues
  • #701
Closed
Open
Issue created Dec 23, 2018 by Albert Astals Cid@aacidOwner

heap buffer overflow in ArthurOutputDev::drawChar

second page of this file bug-poppler51369.pdf gives a heap buffer overflow issue on an asan build of poppler master

==8318==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200107259c at pc 0x7f01ee52866a bp 0x7ffd485f7090 sp 0x7ffd485f7088
READ of size 4 at 0x60200107259c thread T0
    #0 0x7f01ee528669 in ArthurOutputDev::drawChar(GfxState*, double, double, double, double, double, double, unsigned int, int, unsigned int*, int) /home/tsdgeos/devel/poppler/qt5/src/ArthurOutputDev.cc:943:42
    #1 0x7f01ecc3ef78 in Gfx::doShowText(GooString const*) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:4041:14
    #2 0x7f01ecbea4df in Gfx::opShowSpaceText(Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:3859:7
    #3 0x7f01ecc02de8 in Gfx::execOp(Object*, Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:876:3
    #4 0x7f01ecc01b15 in Gfx::go(bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:752:7
    #5 0x7f01ecc01289 in Gfx::display(Object*, bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:714:3
    #6 0x7f01ece3112a in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/Page.cc:548:10
    #7 0x7f01ece445a5 in PDFDoc::displayPageSlice(OutputDev*, int, double, double, int, bool, bool, bool, int, int, int, int, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/PDFDoc.cc:664:20
    #8 0x7f01ee4df03b in Poppler::renderToArthur(Poppler::QImageDumpingArthurOutputDev*, QPainter*, Poppler::PageData*, double, double, int, int, int, int, Poppler::Page::Rotation, QFlags<Poppler::Page::PainterFlag>) /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:491:25
    #9 0x7f01ee4dd8c6 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:622:7
    #10 0x7f01ee4dc351 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:519:10
    #11 0x7f01ee4dc1c7 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:514:10

0x60200107259c is located 5 bytes to the right of 7-byte region [0x602001072590,0x602001072597)
freed by thread T0 here:
    #0 0x55e0328c1fe1 in free (/home/tsdgeos/devel/poppler/build-asan-ubsan/qt5/tests/test-render-to-file-qt5+0xf4fe1)
    #1 0x7f01ece131eb in gfree(void*) /home/tsdgeos/devel/poppler/goo/gmem.h:61:5
    #2 0x7f01ece131eb in Object::free() /home/tsdgeos/devel/poppler/poppler/Object.cc:102
    #3 0x7f01ece38b91 in Object::~Object() /home/tsdgeos/devel/poppler/poppler/Object.h:153:15
    #4 0x7f01ece38b91 in Parser::~Parser() /home/tsdgeos/devel/poppler/poppler/Parser.cc:58
    #5 0x7f01ecf8045d in XRef::fetch(int, int, int) /home/tsdgeos/devel/poppler/poppler/XRef.cc:1133:5
    #6 0x7f01ece12fc1 in Object::fetch(XRef*, int) const /home/tsdgeos/devel/poppler/poppler/Object.cc:92:16
    #7 0x7f01ecc6f76e in GfxFont::readEmbFontFile(XRef*, int*) /home/tsdgeos/devel/poppler/poppler/GfxFont.cc:822:22
    #8 0x7f01ee51ea16 in ArthurOutputDev::updateFont(GfxState*) /home/tsdgeos/devel/poppler/qt5/src/ArthurOutputDev.cc:551:29
    #9 0x7f01ecbea116 in Gfx::opShowSpaceText(Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:3838:10
    #10 0x7f01ecc02de8 in Gfx::execOp(Object*, Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:876:3
    #11 0x7f01ecc01b15 in Gfx::go(bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:752:7
    #12 0x7f01ecc01289 in Gfx::display(Object*, bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:714:3
    #13 0x7f01ece3112a in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/Page.cc:548:10
    #14 0x7f01ece445a5 in PDFDoc::displayPageSlice(OutputDev*, int, double, double, int, bool, bool, bool, int, int, int, int, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/PDFDoc.cc:664:20
    #15 0x7f01ee4df03b in Poppler::renderToArthur(Poppler::QImageDumpingArthurOutputDev*, QPainter*, Poppler::PageData*, double, double, int, int, int, int, Poppler::Page::Rotation, QFlags<Poppler::Page::PainterFlag>) /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:491:25
    #16 0x7f01ee4dd8c6 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:622:7
    #17 0x7f01ee4dc351 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:519:10
    #18 0x7f01ee4dc1c7 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:514:10

previously allocated by thread T0 here:
    #0 0x55e0328c23c9 in __interceptor_malloc (/home/tsdgeos/devel/poppler/build-asan-ubsan/qt5/tests/test-render-to-file-qt5+0xf53c9)
    #1 0x7f01eca33ffc in gmalloc(unsigned long, bool) /home/tsdgeos/devel/poppler/goo/gmem.h:41:17
    #2 0x7f01eca33ffc in copyString(char const*) /home/tsdgeos/devel/poppler/goo/gmem.h:169
    #3 0x7f01ecad9b57 in Object::Object(ObjType, char const*) /home/tsdgeos/devel/poppler/poppler/Object.h:166:93
    #4 0x7f01ecdf386f in Lexer::getObj(int) /home/tsdgeos/devel/poppler/poppler/Lexer.cc
    #5 0x7f01ece3be85 in Parser::shift(char const*, int) /home/tsdgeos/devel/poppler/poppler/Parser.cc:348:19
    #6 0x7f01ece3b012 in Parser::makeStream(Object&&, unsigned char*, CryptAlgorithm, int, int, int, int, bool) /home/tsdgeos/devel/poppler/poppler/Parser.cc:264:3
    #7 0x7f01ece39b7d in Parser::getObj(bool, unsigned char*, CryptAlgorithm, int, int, int, int, bool) /home/tsdgeos/devel/poppler/poppler/Parser.cc:134:34
    #8 0x7f01ecf80447 in XRef::fetch(int, int, int) /home/tsdgeos/devel/poppler/poppler/XRef.cc:1131:26
    #9 0x7f01ece12fc1 in Object::fetch(XRef*, int) const /home/tsdgeos/devel/poppler/poppler/Object.cc:92:16
    #10 0x7f01ecc6f76e in GfxFont::readEmbFontFile(XRef*, int*) /home/tsdgeos/devel/poppler/poppler/GfxFont.cc:822:22
    #11 0x7f01ee51ea16 in ArthurOutputDev::updateFont(GfxState*) /home/tsdgeos/devel/poppler/qt5/src/ArthurOutputDev.cc:551:29
    #12 0x7f01ecbea116 in Gfx::opShowSpaceText(Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:3838:10
    #13 0x7f01ecc02de8 in Gfx::execOp(Object*, Object*, int) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:876:3
    #14 0x7f01ecc01b15 in Gfx::go(bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:752:7
    #15 0x7f01ecc01289 in Gfx::display(Object*, bool) /home/tsdgeos/devel/poppler/poppler/Gfx.cc:714:3
    #16 0x7f01ece3112a in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/Page.cc:548:10
    #17 0x7f01ece445a5 in PDFDoc::displayPageSlice(OutputDev*, int, double, double, int, bool, bool, bool, int, int, int, int, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /home/tsdgeos/devel/poppler/poppler/PDFDoc.cc:664:20
    #18 0x7f01ee4df03b in Poppler::renderToArthur(Poppler::QImageDumpingArthurOutputDev*, QPainter*, Poppler::PageData*, double, double, int, int, int, int, Poppler::Page::Rotation, QFlags<Poppler::Page::PainterFlag>) /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:491:25
    #19 0x7f01ee4dd8c6 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:622:7
    #20 0x7f01ee4dc351 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation, void (*)(QImage const&, QVariant const&), bool (*)(QVariant const&), QVariant const&) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:519:10
    #21 0x7f01ee4dc1c7 in Poppler::Page::renderToImage(double, double, int, int, int, int, Poppler::Page::Rotation) const /home/tsdgeos/devel/poppler/qt5/src/poppler-page.cc:514:10
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking