Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stack overflow in ParseLastXrefPosition [1] #278

Closed
MinghaoLin2000 opened this issue Aug 19, 2024 · 1 comment
Closed

Stack overflow in ParseLastXrefPosition [1] #278

MinghaoLin2000 opened this issue Aug 19, 2024 · 1 comment

Comments

@MinghaoLin2000
Copy link

I fuzz the parsePDF functionality using harness PDFParserFuzzingHarness provided in this project. My fuzzer found a stack overflow crash. below is sanitizer's message.
==955==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc697a9ff8 (pc 0x5640d42640f1 bp 0x00000000001e sp 0x7ffc697aa000 T0) #0 0x5640d42640f1 in __asan::GetCurrentThread() crtstuff.c #1 0x5640d42619fd in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int) crtstuff.c #2 0x5640d429196e in operator new(unsigned long) (/PDF-Writer/build/PDFWriterTesting/PDFParserFuzzingHarness+0x16296e) (BuildId: 3573c99225bcd3d6) #3 0x5640d42cda71 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:590:22 #4 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #5 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #6 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #7 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #8 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #9 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #10 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #11 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #12 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #13 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #14 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #15 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #16 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #17 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #18 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16 #19 0x5640d42cdfc3 in PDFObjectParser::ParseArray() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603:35 #20 0x5640d42c5f6a in PDFObjectParser::ParseNewObject() /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200:16
This backtrace message is incomplete due to the screen limitation. I utilize GDB to retrieve the initial parts of backtrace.
#13438 0x000055762a2ecfc4 in PDFObjectParser::ParseArray (this=<optimized out>) at /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603 #13439 0x000055762a2e4f6b in PDFObjectParser::ParseNewObject (this=<optimized out>) at /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200 #13440 0x000055762a2ecfc4 in PDFObjectParser::ParseArray (this=<optimized out>) at /PDF-Writer/PDFWriter/PDFObjectParser.cpp:603 #13441 0x000055762a2e4f6b in PDFObjectParser::ParseNewObject (this=<optimized out>) at /PDF-Writer/PDFWriter/PDFObjectParser.cpp:200 #13442 0x000055762a2b8546 in PDFParser::ParseLastXrefPosition (this=0x7fc46c700060) at /PDF-Writer/PDFWriter/PDFParser.cpp:363 #13443 0x000055762a2b4bfb in PDFParser::StartPDFParsing (this=0x7fc46c700060, inSourceStream=0x7fc46c700020, inOptions=...) at /PDF-Writer/PDFWriter/PDFParser.cpp:117 #13444 0x000055762a2b3063 in LLVMFuzzerTestOneInput (
It demonstrates that the stack contained so many function frame data that it is overflowed. I have attached my crash sample.
crash.zip

@galkahana
Copy link
Owner

#280 should take care of this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants