Issue metadata
Sign in to add a comment
|
Security: PDFium: Yet Another Out-Of-Bounds Read in CCodec_ProgressiveDecoder::ReSampleScanline
Reported by
stackexp...@gmail.com,
Jun 2 2016
|
||||||||||||||||||||||||||||||||
Issue description
Security: PDFium: Yet Another Out-Of-Bounds Read in CCodec_ProgressiveDecoder::ReSampleScanline
VULNERABILITY DETAILS
This Out-Of-Bounds Read vulnerability was caused by the malformed gif file embedded in the PDF document. More specifically, this issue can be triggered by embedding a malformed gif file in the XFA component.
The latest dev version of chrome (52.0.2743.19 dev-m) was vulnerable to this issue.
---------------------------
Exception Information
---------------------------
(4dcc.1bc4): Access violation - code c0000005 (!!! second chance !!!)
eax=00000003 ebx=00000001 ecx=0962eff8 edx=00010000 esi=09628394 edi=09626f38
eip=0176058b esp=0028f644 ebp=0028f680 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
pdfium_test!CCodec_ProgressiveDecoder::ReSampleScanline+0x56b:
0176058b 8b0c81 mov ecx,dword ptr [ecx+eax*4] ds:002b:0962f004=????????
---------------------------
Heap Information
---------------------------
0:000> !heap -p -a ecx
address 0962eff8 found in
_DPH_HEAP_ROOT @ 5901000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
a103784: 962eff8 8 - 962e000 2000
61a48e89 verifier!AVrfDebugPageHeapAllocate+0x00000229
77621d4e ntdll!RtlDebugAllocateHeap+0x00000030
775db586 ntdll!RtlpAllocateHeap+0x000000c4
77583541 ntdll!RtlAllocateHeap+0x0000023a
0170ded4 pdfium_test!_calloc_base+0x00000047 [d:\th\minkernel\crts\ucrt\src\appcrt\heap\calloc_base.cpp @ 33]
0175f309 pdfium_test!CCodec_ProgressiveDecoder::GifInputRecordPositionBufCallback+0x00000059 [core\fxcodec\codec\fx_codec_progress.cpp @ 642]
01761c81 pdfium_test!gif_get_record_position+0x00000051 [core\fxcodec\codec\fx_codec_gif.cpp @ 67]
01765548 pdfium_test!gif_load_frame+0x00000148 [core\fxcodec\lgif\fx_gif.cpp @ 862]
01761965 pdfium_test!CCodec_GifModule::LoadFrame+0x00000035 [core\fxcodec\codec\fx_codec_gif.cpp @ 146]
0175ded9 pdfium_test!CCodec_ProgressiveDecoder::ContinueDecode+0x00000219 [core\fxcodec\codec\fx_codec_progress.cpp @ 2119]
01601b22 pdfium_test!XFA_LoadImageFromBuffer+0x000001b2 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1107]
01601927 pdfium_test!XFA_LoadImageData+0x00000277 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1032]
015f514b pdfium_test!CXFA_ImageLayoutData::LoadImageData+0x0000006b [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 96]
015f51b1 pdfium_test!CXFA_WidgetAcc::LoadImageImage+0x00000011 [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 1002]
015ecfa8 pdfium_test!CXFA_FFPageWidgetIterator::MoveToNext+0x00000018 [xfa\fxfa\app\xfa_ffpageview.cpp @ 166]
013c96b7 pdfium_test!CPDFSDK_Document::GetPageView+0x00000087 [fpdfsdk\fsdk_mgr.cpp @ 268]
013be73e pdfium_test!FORM_OnAfterLoadPage+0x0000002e [fpdfsdk\fpdfformfill.cpp @ 642]
013b5517 pdfium_test!RenderPage+0x00000047 [samples\pdfium_test.cc @ 498]
013b5b02 pdfium_test!RenderPdf+0x00000302 [samples\pdfium_test.cc @ 694]
013bbb1e pdfium_test!main+0x0000042e [samples\pdfium_test.cc @ 836]
016f05d6 pdfium_test!__scrt_common_main_seh+0x000000ff [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264]
7528338a kernel32!BaseThreadInitThunk+0x0000000e
77589a02 ntdll!__RtlUserThreadStart+0x00000070
775899d5 ntdll!_RtlUserThreadStart+0x0000001b
---------------------------
Source Code Information
---------------------------
case 12: {
if (m_pBmpContext) {
int des_r = 0, des_g = 0, des_b = 0;
for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
j++) {
int pixel_weight =
pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
unsigned long argb = m_pSrcPalette[src_scan[j]];
des_r += pixel_weight * (uint8_t)(argb >> 16);
des_g += pixel_weight * (uint8_t)(argb >> 8);
des_b += pixel_weight * (uint8_t)argb;
}
*des_scan++ = (uint8_t)((des_b) >> 16);
*des_scan++ = (uint8_t)((des_g) >> 16);
*des_scan++ = (uint8_t)((des_r) >> 16);
*des_scan++ = 0xFF;
} else {
int des_a = 0, des_r = 0, des_g = 0, des_b = 0;
for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
j++) {
int pixel_weight =
pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
unsigned long argb = m_pSrcPalette[src_scan[j]]; // <------------------ CRASHED!!!
des_a += pixel_weight * (uint8_t)(argb >> 24);
des_r += pixel_weight * (uint8_t)(argb >> 16);
des_g += pixel_weight * (uint8_t)(argb >> 8);
des_b += pixel_weight * (uint8_t)argb;
}
*des_scan++ = (uint8_t)((des_b) >> 16);
*des_scan++ = (uint8_t)((des_g) >> 16);
*des_scan++ = (uint8_t)((des_r) >> 16);
*des_scan++ = (uint8_t)((des_a) >> 16);
}
} break;
---------------------------
Stacktrace Information
---------------------------
0:000> k
ChildEBP RetAddr
0028f680 0175f776 pdfium_test!CCodec_ProgressiveDecoder::ReSampleScanline+0x56b [core\fxcodec\codec\fx_codec_progress.cpp @ 1595]
0028f6bc 01761caa pdfium_test!CCodec_ProgressiveDecoder::GifReadScanlineCallback+0x126 [core\fxcodec\codec\fx_codec_progress.cpp @ 744]
0028f6d0 017657d1 pdfium_test!gif_read_scanline+0x1a [core\fxcodec\codec\fx_codec_gif.cpp @ 50]
0028f700 01761965 pdfium_test!gif_load_frame+0x3d1 [core\fxcodec\lgif\fx_gif.cpp @ 924]
0028f724 0175ded9 pdfium_test!CCodec_GifModule::LoadFrame+0x35 [core\fxcodec\codec\fx_codec_gif.cpp @ 146]
0028f768 01601b22 pdfium_test!CCodec_ProgressiveDecoder::ContinueDecode+0x219 [core\fxcodec\codec\fx_codec_progress.cpp @ 2119]
0028f7d0 01601927 pdfium_test!XFA_LoadImageFromBuffer+0x1b2 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1107]
0028f828 015f514b pdfium_test!XFA_LoadImageData+0x277 [xfa\fxfa\app\xfa_ffwidget.cpp @ 1032]
0028f85c 015f51b1 pdfium_test!CXFA_ImageLayoutData::LoadImageData+0x6b [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 96]
0028f868 0167a488 pdfium_test!CXFA_WidgetAcc::LoadImageImage+0x11 [xfa\fxfa\app\xfa_ffwidgetacc.cpp @ 1002]
0028f870 015ecd83 pdfium_test!CXFA_FFImage::LoadWidget+0x28 [xfa\fxfa\app\xfa_ffimage.cpp @ 28]
0028f884 015ecfa8 pdfium_test!CXFA_FFPageWidgetIterator::GetWidget+0x83 [xfa\fxfa\app\xfa_ffpageview.cpp @ 198]
0028f894 013c9f4d pdfium_test!CXFA_FFPageWidgetIterator::MoveToNext+0x18 [xfa\fxfa\app\xfa_ffpageview.cpp @ 166]
0028f8c4 013c96b7 pdfium_test!CPDFSDK_PageView::LoadFXAnnots+0x8d [fpdfsdk\fsdk_mgr.cpp @ 921]
0028f8d8 013be73e pdfium_test!CPDFSDK_Document::GetPageView+0x87 [fpdfsdk\fsdk_mgr.cpp @ 268]
(Inline) -------- pdfium_test!?A0x06ce08b4::FormHandleToPageView+0x2a [fpdfsdk\fpdfformfill.cpp @ 45]
0028f8ec 013b5517 pdfium_test!FORM_OnAfterLoadPage+0x2e [fpdfsdk\fpdfformfill.cpp @ 642]
0028f9e0 013b5b02 pdfium_test!RenderPage+0x47 [samples\pdfium_test.cc @ 498]
0028fafc 013bbb1e pdfium_test!RenderPdf+0x302 [samples\pdfium_test.cc @ 694]
0028fc38 016f05d6 pdfium_test!main+0x42e [samples\pdfium_test.cc @ 836]
(Inline) -------- pdfium_test!invoke_main+0x1d [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 74]
0028fc84 7528338a pdfium_test!__scrt_common_main_seh+0xff [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264]
0028fc90 77589a02 kernel32!BaseThreadInitThunk+0xe
0028fcd0 775899d5 ntdll!__RtlUserThreadStart+0x70
0028fce8 00000000 ntdll!_RtlUserThreadStart+0x1b
---------------------------
PoC Diff
---------------------------
I've tried to do some difference reduction work. But there were too many changes between the original gif file and the mutated gif file.
VERSION
Chrome Version: [52.0.2743.19] + [dev]
Operating System: [Windows 7 SP1]
REPRODUCTION CASE
Both the original normal gif file, the malformed gif file, and the proof-of-concept PDF file were attached.
FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab]
,
Jun 2 2016
,
Jun 3 2016
This time I will attach the minimized proof-of-concept files. The difference between the seed image and proof-of-concept image has been reduced to one byte. The 10th byte of the gif image was changed from 0xF7 to 0x77. This mutation could crash pdfium.
---------
SEED
---------
struct Gif.LogicalScreenDescriptor.PackedFields { // 0xF7
UBYTE GlobalColorTableFlag : 1; // 1
UBYTE ColorResolution : 3; // 7
UBYTE SortFlag : 1; // 0
UBYTE SizeOfGlobalColorTable : 3; // 7
}
---------
POC
---------
struct Gif.LogicalScreenDescriptor.PackedFields { // 0x77
UBYTE GlobalColorTableFlag : 1; // 0 <-------- flipped
UBYTE ColorResolution : 3; // 7
UBYTE SortFlag : 1; // 0
UBYTE SizeOfGlobalColorTable : 3; // 7
}
To conclude, the |GlobalColorTableFlag| was flipped from 1 to 0.
,
Jun 3 2016
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=5712389257560064
,
Jun 3 2016
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=4859911976779776
,
Jun 3 2016
Thanks for the report. tsepez, when it rains it pours...! PTAL?
,
Jun 3 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4859911976779776 Uploader: felt@google.com Job Type: linux_asan_pdfium Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900000209c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=393856:393893 Minimized Testcase (5.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97-WTTEvE5sX8FVcA_mJC3KM2T-CabbufIRiZG9YQwgpXYwuAnGlzyWxYGeTRy8xQ6_DJt59BqdDfWcVcstuX0wTL4MWSdibU9Mcxiodm4X0OnsoHI7GZF_pokdg2Nm3surKXJ_LwKTVum1Cgt8CwBXYJNtrg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 3 2016
,
Jun 3 2016
,
Jun 3 2016
,
Jun 3 2016
hong_zhang, could you please route this security bug to the appropriate person? thanks.
,
Jun 4 2016
This issue is a security regression. If you are not able to fix this quickly, please revert the change that introduced it. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 8 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4602825703424000 Uploader: felt@google.com Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900000ed5c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=393856:393893 Minimized Testcase (5.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94yML7H2Gy2f631uNxuwgj_OJFwl3iIOGEzcWby139fX_GWR93mrpnarGffBnMvelAFohLztc_itTp7MMnSDdDSezMjDzVA-N0AiuOgwRMczxcmaPjh3xeoi4iTHjAorw_rhXafYCJwTyqTTmELU-lbpRO_lg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.
,
Jun 10 2016
ClusterFuzz has detected this issue as fixed in range 399086:399117. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4859911976779776 Uploader: felt@google.com Job Type: linux_asan_pdfium Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900000209c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=393856:393893 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_pdfium&range=399086:399117 Minimized Testcase (5.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97-WTTEvE5sX8FVcA_mJC3KM2T-CabbufIRiZG9YQwgpXYwuAnGlzyWxYGeTRy8xQ6_DJt59BqdDfWcVcstuX0wTL4MWSdibU9Mcxiodm4X0OnsoHI7GZF_pokdg2Nm3surKXJ_LwKTVum1Cgt8CwBXYJNtrg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 10 2016
ClusterFuzz has detected this issue as fixed in range 399086:399117. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4602825703424000 Uploader: felt@google.com Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900000ed5c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=393856:393893 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=399086:399117 Minimized Testcase (5.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94yML7H2Gy2f631uNxuwgj_OJFwl3iIOGEzcWby139fX_GWR93mrpnarGffBnMvelAFohLztc_itTp7MMnSDdDSezMjDzVA-N0AiuOgwRMczxcmaPjh3xeoi4iTHjAorw_rhXafYCJwTyqTTmELU-lbpRO_lg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 10 2016
ClusterFuzz has detected this issue as fixed in range 399086:399117. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=4602825703424000 Uploader: felt@google.com Job Type: linux_asan_chrome_mp Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60900000ed5c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=393856:393893 Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_asan_chrome_mp&range=399086:399117 Minimized Testcase (5.42 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94yML7H2Gy2f631uNxuwgj_OJFwl3iIOGEzcWby139fX_GWR93mrpnarGffBnMvelAFohLztc_itTp7MMnSDdDSezMjDzVA-N0AiuOgwRMczxcmaPjh3xeoi4iTHjAorw_rhXafYCJwTyqTTmELU-lbpRO_lg See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Jun 13 2016
,
Jun 14 2016
ClusterFuzz testcase is verified as fixed, closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Jun 14 2016
,
Jun 14 2016
Sorry for the incorrect ClusterFuzz update, please ignore it. Reopening bug.
,
Jun 15 2016
[Bulk edit] Per inferno@, Security_Impact=None bugs should not be release blockers.
,
Jun 15 2016
,
Jun 16 2016
,
Jun 22 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5687426890858496 Fuzzer: pdf_codec_gif_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60300000ed3c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=400757:400887 Minimized Testcase (0.17 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94FD_pZpsR06g0bI-TG8gbBohMzzmCKVriqnunDi3iAkHgFLD2ysvW6qmdnzql7SvCnTwzqMfzx_C88pkvE8k-3G_0IW6YSjU5Ugl3OnGbQ5thTELKr6d2wHTfhE4spUmzw8wqtZPJ9nvo__1nUPPgEdvJs0A?testcase_id=5687426890858496 Filer: mmoroz See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Jul 31 2016
ClusterFuzz has detected this issue as fixed in range 408652:408744. Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5687426890858496 Fuzzer: pdf_codec_gif_fuzzer Job Type: libfuzzer_chrome_asan Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60300000ed3c Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=400757:400887 Fixed: https://cluster-fuzz.appspot.com/revisions?job=libfuzzer_chrome_asan&range=408652:408744 Minimized Testcase (0.17 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94FD_pZpsR06g0bI-TG8gbBohMzzmCKVriqnunDi3iAkHgFLD2ysvW6qmdnzql7SvCnTwzqMfzx_C88pkvE8k-3G_0IW6YSjU5Ugl3OnGbQ5thTELKr6d2wHTfhE4spUmzw8wqtZPJ9nvo__1nUPPgEdvJs0A?testcase_id=5687426890858496 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 1 2016
Detailed report: https://cluster-fuzz.appspot.com/testcase?key=6010965573500928 Fuzzer: afl_pdf_codec_gif_fuzzer Job Type: afl_chrome_asan Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60a00000ecf0 Crash State: CCodec_ProgressiveDecoder::ReSampleScanline CCodec_ProgressiveDecoder::GifReadScanlineCallback gif_load_frame Recommended Security Severity: Medium Regressed: https://cluster-fuzz.appspot.com/revisions?job=afl_chrome_asan&range=402185:402404 Minimized Testcase (0.19 Kb): https://cluster-fuzz.appspot.com/download/AMIfv94uAyHmXqa3aXCUJBkPUaMUj1M50TTjGap1PrO4tU4fmA7h2KnvCCoaOBZz0A4ftNK3p_reOJmcoRmPUFHkD_TlJRM-xFh_HlovtD5-1nxjgNsKjcLV3Q_Cr1i3sCVljyHV3-zXj2ikekUoFOipqG7bf7MOgw?testcase_id=6010965573500928 See https://chromium.googlesource.com/chromium/src/+/master/testing/libfuzzer/reproducing.md for more information.
,
Oct 8 2016
Kindly reminder: this issue is still reproducible.
,
Oct 14 2016
,
Dec 5 2016
ClusterFuzz testcase is flaky and no longer reproduces, so closing issue. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Dec 6 2016
==23891==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf072ed1c at pc 0x09ea497b bp 0xff867ac8 sp 0xff867ac0
READ of size 4 at 0xf072ed1c thread T0
#0 0x9ea497a in CCodec_ProgressiveDecoder::ReSampleScanline(CFX_DIBitmap*, int, unsigned char*, CCodec_ProgressiveDecoder::FXCodec_Format) core/fxcodec/codec/fx_codec_progress.cpp:1618:34
#1 0x9ea192c in CCodec_ProgressiveDecoder::GifReadScanlineCallback(void*, int, unsigned char*) core/fxcodec/codec/fx_codec_progress.cpp:769:11
#2 0x9ed37d7 in gif_read_scanline(tag_gif_decompress_struct*, int, unsigned char*) core/fxcodec/codec/fx_codec_gif.cpp:50:3
#3 0x9f036a0 in gif_load_frame(tag_gif_decompress_struct*, int) core/fxcodec/lgif/fx_gif.cpp:931:11
#4 0x9ed4836 in CCodec_GifModule::LoadFrame(FXGIF_Context*, int, CFX_DIBAttribute*) core/fxcodec/codec/fx_codec_gif.cpp:146:17
#5 0x9ebc0f6 in CCodec_ProgressiveDecoder::ContinueDecode(IFX_Pause*) core/fxcodec/codec/fx_codec_progress.cpp:2166:25
#6 0x94b5f61 in XFA_LoadImageFromBuffer(IFX_SeekableReadStream*, FXCODEC_IMAGE_TYPE, int&, int&) xfa/fxfa/app/xfa_ffwidget.cpp:1167:28
#7 0x94b414f in XFA_LoadImageData(CXFA_FFDoc*, CXFA_Image*, bool&, int&, int&) xfa/fxfa/app/xfa_ffwidget.cpp:1095:7
#8 0x94e1903 in CXFA_ImageLayoutData::LoadImageData(CXFA_WidgetAcc*) xfa/fxfa/app/xfa_ffwidgetacc.cpp:97:25
#9 0x94d4431 in CXFA_WidgetAcc::LoadImageImage() xfa/fxfa/app/xfa_ffwidgetacc.cpp:999:9
#10 0x99260ff in CXFA_FFImage::LoadWidget() xfa/fxfa/app/xfa_ffimage.cpp:27:17
#11 0x94834c8 in CXFA_FFPageWidgetIterator::GetWidget(CXFA_LayoutItem*) xfa/fxfa/app/xfa_ffpageview.cpp:208:16
#12 0x948364e in CXFA_FFPageWidgetIterator::MoveToNext() xfa/fxfa/app/xfa_ffpageview.cpp:178:34
#13 0x824dac9 in CPDFSDK_PageView::LoadFXAnnots() fpdfsdk/cpdfsdk_pageview.cpp:411:54
#14 0x8215b4f in CPDFSDK_FormFillEnvironment::GetPageView(CPDFXFA_Page*, bool) fpdfsdk/cpdfsdk_formfillenvironment.cpp:587:14
#15 0x81d12d9 in (anonymous namespace)::FormHandleToPageView(void*, void*) fpdfsdk/fpdfformfill.cpp:58:39
#16 0x81d5c4d in FORM_OnAfterLoadPage fpdfsdk/fpdfformfill.cpp:657:37
#17 0x8150ff7 in GetPageForIndex(_FPDF_FORMFILLINFO*, void*, int) samples/pdfium_test.cc:590:3
#18 0x815142d in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void*, void*&, FPDF_FORMFILLINFO_PDFiumTest&, int, Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:604:20
#19 0x8155e1b in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned int, Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:820:9
#20 0x8159987 in main samples/pdfium_test.cc:955:5
#21 0xf3ff7636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
0xf072ed1c is located 4 bytes to the right of 8-byte region [0xf072ed10,0xf072ed18)
allocated by thread T0 here:
#0 0x8108e06 in __interceptor_calloc (/home/worker/Desktop/repo/pdfium/out/Debug/pdfium_test+0x8108e06)
#1 0x81f2d5d in FX_AllocOrDie(unsigned int, unsigned int) core/fxcrt/fx_memory.h:40:22
#2 0x9e9faf7 in CCodec_ProgressiveDecoder::GifInputRecordPositionBufCallback(void*, unsigned int, FX_RECT const&, int, void*, int, bool, int, int, bool) core/fxcodec/codec/fx_codec_progress.cpp:666:29
#3 0x9ed3c07 in gif_get_record_position(tag_gif_decompress_struct*, unsigned int, int, int, int, int, int, void*, int, bool, int, int, bool) core/fxcodec/codec/fx_codec_gif.cpp:67:10
#4 0x9f02721 in gif_load_frame(tag_gif_decompress_struct*, int) core/fxcodec/lgif/fx_gif.cpp:876:19
#5 0x9ed4836 in CCodec_GifModule::LoadFrame(FXGIF_Context*, int, CFX_DIBAttribute*) core/fxcodec/codec/fx_codec_gif.cpp:146:17
#6 0x9ebc0f6 in CCodec_ProgressiveDecoder::ContinueDecode(IFX_Pause*) core/fxcodec/codec/fx_codec_progress.cpp:2166:25
#7 0x94b5f61 in XFA_LoadImageFromBuffer(IFX_SeekableReadStream*, FXCODEC_IMAGE_TYPE, int&, int&) xfa/fxfa/app/xfa_ffwidget.cpp:1167:28
#8 0x94b414f in XFA_LoadImageData(CXFA_FFDoc*, CXFA_Image*, bool&, int&, int&) xfa/fxfa/app/xfa_ffwidget.cpp:1095:7
#9 0x94e1903 in CXFA_ImageLayoutData::LoadImageData(CXFA_WidgetAcc*) xfa/fxfa/app/xfa_ffwidgetacc.cpp:97:25
#10 0x94d4431 in CXFA_WidgetAcc::LoadImageImage() xfa/fxfa/app/xfa_ffwidgetacc.cpp:999:9
#11 0x99260ff in CXFA_FFImage::LoadWidget() xfa/fxfa/app/xfa_ffimage.cpp:27:17
#12 0x94834c8 in CXFA_FFPageWidgetIterator::GetWidget(CXFA_LayoutItem*) xfa/fxfa/app/xfa_ffpageview.cpp:208:16
#13 0x948364e in CXFA_FFPageWidgetIterator::MoveToNext() xfa/fxfa/app/xfa_ffpageview.cpp:178:34
#14 0x824dac9 in CPDFSDK_PageView::LoadFXAnnots() fpdfsdk/cpdfsdk_pageview.cpp:411:54
#15 0x8215b4f in CPDFSDK_FormFillEnvironment::GetPageView(CPDFXFA_Page*, bool) fpdfsdk/cpdfsdk_formfillenvironment.cpp:587:14
#16 0x81d12d9 in (anonymous namespace)::FormHandleToPageView(void*, void*) fpdfsdk/fpdfformfill.cpp:58:39
#17 0x81d5c4d in FORM_OnAfterLoadPage fpdfsdk/fpdfformfill.cpp:657:37
#18 0x8150ff7 in GetPageForIndex(_FPDF_FORMFILLINFO*, void*, int) samples/pdfium_test.cc:590:3
#19 0x815142d in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void*, void*&, FPDF_FORMFILLINFO_PDFiumTest&, int, Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:604:20
#20 0x8155e1b in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned int, Options const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) samples/pdfium_test.cc:820:9
#21 0x8159987 in main samples/pdfium_test.cc:955:5
#22 0xf3ff7636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
SUMMARY: AddressSanitizer: heap-buffer-overflow core/fxcodec/codec/fx_codec_progress.cpp:1618:34 in CCodec_ProgressiveDecoder::ReSampleScanline(CFX_DIBitmap*, int, unsigned char*, CCodec_ProgressiveDecoder::FXCodec_Format)
Shadow bytes around the buggy address:
0x3e0e5d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3e0e5d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3e0e5d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3e0e5d80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x3e0e5d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x3e0e5da0: fa fa 00[fa]fa fa 04 fa fa fa 00 01 fa fa 05 fa
0x3e0e5db0: fa fa 06 fa fa fa 00 00 fa fa 04 fa fa fa 00 00
0x3e0e5dc0: fa fa 04 fa fa fa 04 fa fa fa 00 00 fa fa 00 fa
0x3e0e5dd0: fa fa 00 04 fa fa 04 fa fa fa 00 00 fa fa 04 fa
0x3e0e5de0: fa fa fd fd fa fa fd fd fa fa 00 04 fa fa fd fd
0x3e0e5df0: fa fa fd fd fa fa fd fd fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23891==ABORTING
,
Dec 6 2016
Hello, this issue is still reproducible, please re-open it and mark it as ClusterFuzz-Wrong, thanks.
,
Dec 6 2016
,
Dec 7 2016
,
Mar 16 2017
,
Jul 27 2017
Any chance to fix this? There are other invariants of this crash, e.g. https://clusterfuzz.com/v2/testcase-detail/5305773927432192 In total, this crash happens in 97+% of fuzzer runs: https://clusterfuzz.com/v2/performance-report/libFuzzer_pdf_codec_gif_fuzzer/libfuzzer_chrome_asan/latest It's a real blocker for gaining new coverage and performing continuous testing.
,
Jul 27 2017
,
Jul 27 2017
It might help if it were assigned to a team member rather than FX.
,
Jul 28 2017
Is this really security impact none, this should affect prod, no ?
,
Jul 28 2017
dsinclair: Uh oh! This issue still open and hasn't been updated in the last 233 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 28 2017
XFA_LoadImageFromBuffer is XFA, is not enabled in any stable branch.
,
Aug 29 2017
,
Sep 18 2017
We have made a bunch of changes on ClusterFuzz side, so resetting ClusterFuzz-Wrong label.
,
Sep 19 2017
,
Sep 20 2017
,
Sep 20 2017
,
Sep 22 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/73bed4ef57444a2ea066d532a8a82b230fd206d9 commit 73bed4ef57444a2ea066d532a8a82b230fd206d9 Author: Ryan Harrison <rharrison@chromium.org> Date: Fri Sep 22 15:03:06 2017 Fix crash when rendering invalid GIF The core fix in this CL is a change to how LWZ decompression works, so that when the min code table size and the color palette size are different, color codes after the end of the defined color palette are considered errors. This CL also introduces a bunch of tweaks to the call return path, since there were multiple locations where the GIF decode failing status was being dropped on the floor, so the end widget would have a bitmap with the default colour in it, instead of nothing. BUG= chromium:616671 Change-Id: Id6f40d552dc24650c91e9903f710ff2fa63bc774 Reviewed-on: https://pdfium-review.googlesource.com/14630 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org> [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/lgif/cgifcontext.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/lgif/fx_gif.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/codec/fx_codec_progress.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/fx_codec_def.h [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/xfa/fxfa/cxfa_ffwidget.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/lgif/fx_gif.h [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/lgif/cgifcontext.h [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/xfa/fxfa/cxfa_ffimage.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/codec/ccodec_gifmodule.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/xfa/fxfa/cxfa_ffpageview.cpp [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/core/fxcodec/codec/ccodec_progressivedecoder.h [modify] https://crrev.com/73bed4ef57444a2ea066d532a8a82b230fd206d9/testing/libfuzzer/xfa_codec_fuzzer.h
,
Sep 22 2017
,
Sep 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/62d2414587ea6ba0c55952dae9064788db264ac0 commit 62d2414587ea6ba0c55952dae9064788db264ac0 Author: pdfium-deps-roller@chromium.org <pdfium-deps-roller@chromium.org> Date: Fri Sep 22 16:18:00 2017 Roll src/third_party/pdfium/ 0150a5455..73bed4ef5 (1 commit) https://pdfium.googlesource.com/pdfium.git/+log/0150a5455829..73bed4ef5744 $ git log 0150a5455..73bed4ef5 --date=short --no-merges --format='%ad %ae %s' 2017-09-22 rharrison Fix crash when rendering invalid GIF Created with: roll-dep src/third_party/pdfium BUG= 616671 Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, see: http://www.chromium.org/developers/tree-sheriffs/sheriff-details-chromium#TOC-Failures-due-to-DEPS-rolls TBR=dsinclair@chromium.org Change-Id: I057608cd564cde4d6a11c4ebffd04a192133e43f Reviewed-on: https://chromium-review.googlesource.com/678914 Reviewed-by: <pdfium-deps-roller@chromium.org> Commit-Queue: <pdfium-deps-roller@chromium.org> Cr-Commit-Position: refs/heads/master@{#503759} [modify] https://crrev.com/62d2414587ea6ba0c55952dae9064788db264ac0/DEPS
,
Dec 30 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||||||||
Comment 1 Deleted