Security: PDFium: Heap Buffer Overflow in CGifLZWDecoder::ClearTable

VULNERABILITY DETAILS
This heap-buffer-overflow vulnerability was caused by the malformed gif file embedded in the PDF document. More specifically, this issue can be triggered by embedding a malformed gif file in the XFA component.

The latest dev version of chrome (52.0.2743.19 dev-m) was vulnerable to this issue.

---------------------------
Exception Information
---------------------------
(55ec.4258): Access violation - code c0000005 (!!! second chance !!!)
eax=00001007 ebx=00000100 ecx=00001007 edx=0962cfe0 esi=09692fd8 edi=0962cfe0
eip=00cf4403 esp=0034f880 ebp=0034f888 iopl=0         nv up ei ng nz na po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010283
pdfium_test!CGifLZWDecoder::ClearTable+0x53:
00cf4403 88848e0e100000 mov byte ptr [esi+ecx*4+100Eh],al ds:002b:09698002=??

---------------------------
Heap Information
---------------------------
0:000> !heap -p -a esi
    address 09692fd8 found in
    _DPH_HEAP_ROOT @ 3d1000
    in busy allocation (  DPH_HEAP_BLOCK:  UserAddr  UserSize - VirtAddr  VirtSize)
                                 a1137b8:   9692fd8      5024 -  9692000      7000
    60d78e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
    77621d4e ntdll!RtlDebugAllocateHeap+0x00000030
    775db586 ntdll!RtlpAllocateHeap+0x000000c4
    77583541 ntdll!RtlAllocateHeap+0x0000023a
    00c9e67f pdfium_test!_malloc_base+0x00000038 [d:\th\minkernel\crts\ucrt\src\appcrt\heap\malloc_base.cpp @ 29]
    00c7ff47 pdfium_test!operator new+0x0000002c [f:\dd\vctools\crt\vcstartup\src\heap\new_scalar.cpp @ 19]
    00cf5590 pdfium_test!gif_load_frame+0x00000190 [core\fxcodec\lgif\fx_gif.cpp @ 887]
    00cf1965 pdfium_test!CCodec_GifModule::LoadFrame+0x00000035 [core\fxcodec\codec\fx_codec_gif.cpp @ 146]
    00ceded9 pdfium_test!CCodec_ProgressiveDecoder::ContinueDecode+0x00000219 [core\fxcodec\codec\fx_codec_progress.cpp @ 2119]
    00b91b22 pdfium_test!XFA_LoadImageFromBuffer+0x000001b2 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1107]
    00b91927 pdfium_test!XFA_LoadImageData+0x00000277 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1032]
    00b8514b pdfium_test!CXFA_ImageLayoutData::LoadImageData+0x0000006b [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 96]
    00b851b1 pdfium_test!CXFA_WidgetAcc::LoadImageImage+0x00000011 [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 1002]
    00b7cfa8 pdfium_test!CXFA_FFPageWidgetIterator::MoveToNext+0x00000018 [xfa\fxfa\app\xfa_ffpageview.cpp @ 166]
    009596b7 pdfium_test!CPDFSDK_Document::GetPageView+0x00000087 [fpdfsdk\fsdk_mgr.cpp @ 268]
    0094e73e pdfium_test!FORM_OnAfterLoadPage+0x0000002e [fpdfsdk\fpdfformfill.cpp @ 642]
    00945517 pdfium_test!RenderPage+0x00000047 [samples\pdfium_test.cc @ 498]
    00945b02 pdfium_test!RenderPdf+0x00000302 [samples\pdfium_test.cc @ 694]
    0094bb1e pdfium_test!main+0x0000042e [samples\pdfium_test.cc @ 836]
    00c805d6 pdfium_test!__scrt_common_main_seh+0x000000ff [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264]
    7528338a kernel32!BaseThreadInitThunk+0x0000000e
    77589a02 ntdll!__RtlUserThreadStart+0x00000070
    775899d5 ntdll!_RtlUserThreadStart+0x0000001b

---------------------------
Overflow Information
---------------------------
void CGifLZWDecoder::ClearTable() {
  code_size_cur = code_size + 1;
  code_next = code_end + 1;
  code_old = (uint16_t)-1;
  FXSYS_memset(code_table, 0, sizeof(tag_Table) * GIF_MAX_LZW_CODE);
  FXSYS_memset(stack, 0, GIF_MAX_LZW_CODE);
  for (uint16_t i = 0; i < code_clear; i++) {
    code_table[i].suffix = (uint8_t)i;
  }
}

Here the value of |code_clear| was 0x4000. In other words, the overflow size can be very large (0x2ff9 bytes).

0:000> u eip
pdfium_test!CGifLZWDecoder::ClearTable+0x53 [core\fxcodec\lgif\fx_gif.cpp @ 37]:
00cf4403 88848e0e100000  mov     byte ptr [esi+ecx*4+100Eh],al
00cf440a 40              inc     eax
00cf440b 663b4602        cmp     ax,word ptr [esi+2]                           ; <-------- i < code_clear ?
00cf440f 72ef            jb      pdfium_test!CGifLZWDecoder::ClearTable+0x50 (00cf4400)
00cf4411 5e              pop     esi
00cf4412 c3              ret
00cf4413 cc              int     3
00cf4414 cc              int     3

$$ code_clear
0:000> dw esi+2 L1
09692fda  4000

$$ i
0:000> r eax
eax=00001007

$$ overflow size
0:000> ?4000-1007
Evaluate expression: 12281 = 00002ff9

---------------------------
Stacktrace Information
---------------------------
0:000> k
ChildEBP RetAddr  
0034f880 00cf4883 pdfium_test!CGifLZWDecoder::ClearTable+0x53 [core\fxcodec\lgif\fx_gif.cpp @ 37]
0034f888 00cf55b6 pdfium_test!CGifLZWDecoder::InitTable+0x53 [core\fxcodec\lgif\fx_gif.cpp @ 29]
0034f8b0 00cf1965 pdfium_test!gif_load_frame+0x1b6 [core\fxcodec\lgif\fx_gif.cpp @ 894]
0034f8d4 00ceded9 pdfium_test!CCodec_GifModule::LoadFrame+0x35 [core\fxcodec\codec\fx_codec_gif.cpp @ 146]
0034f918 00b91b22 pdfium_test!CCodec_ProgressiveDecoder::ContinueDecode+0x219 [core\fxcodec\codec\fx_codec_progress.cpp @ 2119]
0034f980 00b91927 pdfium_test!XFA_LoadImageFromBuffer+0x1b2 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1107]
0034f9d8 00b8514b pdfium_test!XFA_LoadImageData+0x277 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1032]
0034fa0c 00b851b1 pdfium_test!CXFA_ImageLayoutData::LoadImageData+0x6b [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 96]
0034fa18 00c0a488 pdfium_test!CXFA_WidgetAcc::LoadImageImage+0x11 [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 1002]
0034fa20 00b7cd83 pdfium_test!CXFA_FFImage::LoadWidget+0x28 [xfa\fxfa\app\xfa_ffimage.cpp @ 28]
0034fa34 00b7cfa8 pdfium_test!CXFA_FFPageWidgetIterator::GetWidget+0x83 [xfa\fxfa\app\xfa_ffpageview.cpp @ 198]
0034fa44 00959f4d pdfium_test!CXFA_FFPageWidgetIterator::MoveToNext+0x18 [xfa\fxfa\app\xfa_ffpageview.cpp @ 166]
0034fa74 009596b7 pdfium_test!CPDFSDK_PageView::LoadFXAnnots+0x8d [fpdfsdk\fsdk_mgr.cpp @ 921]
0034fa88 0094e73e pdfium_test!CPDFSDK_Document::GetPageView+0x87 [fpdfsdk\fsdk_mgr.cpp @ 268]
(Inline) -------- pdfium_test!?A0x06ce08b4::FormHandleToPageView+0x2a [fpdfsdk\fpdfformfill.cpp @ 45]
0034fa9c 00945517 pdfium_test!FORM_OnAfterLoadPage+0x2e [fpdfsdk\fpdfformfill.cpp @ 642]
0034fb90 00945b02 pdfium_test!RenderPage+0x47 [samples\pdfium_test.cc @ 498]
0034fcac 0094bb1e pdfium_test!RenderPdf+0x302 [samples\pdfium_test.cc @ 694]
0034fde8 00c805d6 pdfium_test!main+0x42e [samples\pdfium_test.cc @ 836]
(Inline) -------- pdfium_test!invoke_main+0x1d [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 74]
0034fe34 7528338a pdfium_test!__scrt_common_main_seh+0xff [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264]
0034fe40 77589a02 kernel32!BaseThreadInitThunk+0xe
0034fe80 775899d5 ntdll!__RtlUserThreadStart+0x70
0034fe98 00000000 ntdll!_RtlUserThreadStart+0x1b

---------------------------
PoC Diff
---------------------------
I've tried to do some difference reduction work. But there were too many changes between the original gif file and the mutated gif file.

VERSION
Chrome Version: [52.0.2743.19] + [dev]
Operating System: [Windows 7 SP1]

REPRODUCTION CASE
Both the original normal gif file, the malformed gif file, and the proof-of-concept PDF file were attached.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab]