fuzz on pdf creates double free in evince/poppler

[Stephen Cook]

This bug will probably will effect anything that uses poppler. I will upload an example of one offending pdf. I think any pdf with the appropriate fuzzing can cause the double free...

It should be easy to get the backtrace by using gdb.

This bug could be a security vuln. I don't really know.

[Stephen Cook (siti)]

Someone else has found the same bug:
http://seclists.org/pen-test/2007/Nov/0133.html

[Koen (koen-beek)]

Confirmed with

Linux 2.6.22-14-generic #1 SMP Sun Oct 14 21:45:15 GMT 2007 x86_64 GNU/Linux
evince 2.20.1-0ubuntu1 Document (postscript, pdf) viewer
libpoppler-glib2 0.6-0ubuntu2.1 PDF rendering library (GLib-based shared lib)
libpoppler2 0.6-0ubuntu2.1 PDF rendering library
poppler-utils 0.6-0ubuntu2.1 PDF utilitites (based on libpoppler)

[Koen (koen-beek)]

This a a backtrace of the evince crash (crashed in the libpoppler library)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1082132816 (LWP 19459)]
0x00002ae16f583860 in FormPageWidgets::~FormPageWidgets () from /usr/lib/libpoppler.so.2

[Pedro Villavicencio (pedro)]

this report has been filed here:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/164939

"This bug will probably will effect anything that uses poppler. I will upload an example of one offending pdf. I think any pdf with the appropriate fuzzing can cause the double free..."

pdf:

http://launchpadlibrarian.net/10549755/1930.pdf

stacktrace:

"
Thread 5 (Thread 0xb4bffb90 (LWP 1399)):
#0 0xb7f42410 in __kernel_vsyscall ()
No symbol table info available.
#1 0xb72badd2 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
   from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#2 0xb76e1077 in g_cond_timed_wait_posix_impl (cond=0x844ddc8,
    entered_mutex=0x80, abs_time=0x5)
    at /build/buildd/glib2.0-2.16.3/gthread/gthread-posix.c:242
 result = <value optimized out>
 end_time = {tv_sec = 1215108909, tv_nsec = 253455000}
 timed_out = <value optimized out>
 __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3 0xb7489e31 in g_async_queue_pop_intern_unlocked (queue=0x80e4408,
    try=<value optimized out>, end_time=0xb4bff314)
    at /build/buildd/glib2.0-2.16.3/glib/gasyncqueue.c:365
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4 0xb7489f66 in IA__g_async_queue_timed_pop (queue=0x80e4408,
    end_time=0xb4bff314) at /build/buildd/glib2.0-2.16.3/glib/gasyncqueue.c:491
 retval = <value optimized out>
 __PRETTY_FUNCTION__ = "IA__g_async_queue_timed_pop"
#5 0xb74d85ba in g_thread_pool_thread_proxy (data=0x8408b98)
    at /build/buildd/glib2.0-2.16.3/glib/gthreadpool.c:121
 task = <value optimized out>
 pool = (GRealThreadPool *) 0x8408b98
#6 0xb74d6a6f in g_thread_create_proxy (data=0x8560850)
    at /build/buildd/glib2.0-2.16.3/glib/gthread.c:635
 __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7 0xb72b64fb in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
No symbol table info available.
#8 0xb7238e5e in clone () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.

Thread 2 (Thread 0xb6943b90 (LWP 30693)):
#0 ~FormPageWidgets (this=0xd) at Form.cc:1235
No locals.
#1 0xb6f124ac in ~Page (this=0x8668130) at Page.cc:311
No locals.
#2 0xb6eb50e0 in Catalog::readPageTree (this=0x863a930, pagesDict=0x86651e0,
    attrs=0x0, start=7, alreadyRead=0x8665590 "") at Catalog.cc:311
 kids = {type = objArray, {booln = 140924176, intg = 140924176,
    real = 495.97095527623696, string = 0x8665510,
    name = 0x8665510 "Àšc\b(Uf\b\b", array = 0x8665510, dict = 0x8665510,
    stream = 0x8665510, ref = {num = 140924176, gen = 1082064777},
    cmd = 0x8665510 "Àšc\b(Uf\b\b"}}
 kid = {type = objDict, {booln = 140937568, intg = 140937568,
    real = -4.7765556854525631e-44, string = 0x8668960,
    name = 0x8668960 "Àšc\b\030\222f\b\020", array = 0x8668960,
    dict = 0x8668960, stream = 0x8668960, ref = {num = 140937568,
      gen = -1225716969}, cmd = 0x8668960 "Àšc\b\030\222f\b\020"}}
 kidRef = {type = objRef, {booln = 41, intg = 41,
    real = 2.0256691479491108e-322, string = 0x29,
    name = 0x29 <Address 0x29 out of bounds>, array = 0x29, dict = 0x29,
    stream = 0x29, ref = {num = 41, gen = 0},
    cmd = 0x29 <Address 0x29 out of bounds>}}
 a...

[Pedro Villavicencio (pedro)]

This is still an issue with hardy, not an evince bug but poppler, will look upstream, thanks.

[Pedro Villavicencio (pedro)]

I've sent this upstream at: https://bugs.freedesktop.org/show_bug.cgi?id=16601 ; thanks.

[Pino Toscano (pinotree)]

Should be fixed in the next Poppler release (>= 0.8.5).

[Greg Grossmeier (greg.grossmeier)]

From upstream:
"Should be fixed in the next Poppler release (>= 0.8.5)."

[Pedro Villavicencio (pedro)]

Marking this as fix-committed then, thanks.

[Sebastien Bacher (seb128)]

the new version is in intrepid