New issue
Advanced search Search tips

Issue 654708 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 635565
Owner: ----
Closed: Oct 2016
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

pdfuim CPDF_HintTables::ReadSharedObjHintTable Memory Corruption

Reported by riusks...@gmail.com, Oct 11 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

Steps to reproduce the problem:
open crash.pdf with chrome browser

What is the expected behavior?
process crash

What went wrong?
(2e00.1c1c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=10122a07 edx=00000000 esi=00000016 edi=00000008
eip=10122a07 esp=0043e410 ebp=0043e464 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010212
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Google\Chrome\Application\53.0.2785.143\chrome_child.dll - 
chrome_child!ChromeMain+0x73d888:
10122a07 c7050000000037130000 mov dword ptr ds:[0],1337h ds:0023:00000000=????????

the pdfuim_test stack backtrack in linux:

Stopped reason: SIGABRT
0x00007ffff6bf3cc9 in __GI_raise (sig=sig@entry=0x6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
gdb-peda$ bt
#0  0x00007ffff6bf3cc9 in __GI_raise (sig=sig@entry=0x6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff6bf70d8 in __GI_abort () at abort.c:89
warning: Could not find DWO CU obj/fpdfapi/cpdf_hint_tables.dwo(0xd87bd21a37e73042) referenced by CU at offset 0xadb1db [in module /root/pdfuim/pdfium_test]
#2  0x0000000000dc5840 in int pdfium::base::checked_cast<int, unsigned int>(unsigned int) ()
    at ../../third_party/base/numerics/safe_conversions.h:29
#3  0x0000000000dc4947 in CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream*, unsigned int) ()
    at ../../core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:305
#4  0x0000000000dc5275 in CPDF_HintTables::LoadHintStream(CPDF_Stream*) ()
    at ../../core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:447
warning: Could not find DWO CU obj/fpdfapi/cpdf_data_avail.dwo(0x66d30f6a2be205eb) referenced by CU at offset 0xadb13f [in module /root/pdfuim/pdfium_test]
#5  0x0000000000db0a5f in CPDF_DataAvail::CheckHintTables(CPDF_DataAvail::DownloadHints*) ()
    at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:779
#6  0x0000000000daf7d0 in CPDF_DataAvail::CheckDocStatus(CPDF_DataAvail::DownloadHints*) ()
    at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:276
#7  0x0000000000daf717 in CPDF_DataAvail::IsDocAvail(CPDF_DataAvail::DownloadHints*) ()
    at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:213
warning: Could not find DWO CU obj/pdfium/fpdf_dataavail.dwo(0xe654fb90a2de2565) referenced by CU at offset 0xada8d3 [in module /root/pdfuim/pdfium_test]
#8  0x0000000000d2186c in FPDFAvail_IsDocAvail () at ../../fpdfsdk/fpdf_dataavail.cpp:129
#9  0x0000000000411726 in RenderPdf(std::string const&, char const*, unsigned long, Options const&, std::string const&) () at ../../samples/pdfium_test.cc:652
#10 0x000000000041213e in main () at ../../samples/pdfium_test.cc:878
#11 0x00007ffff6bdeec5 in __libc_start_main (main=0x411c40 <main>, argc=0x2, argv=0x7fffffffe3c8, 
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3b8)
    at libc-start.c:287
#12 0x000000000040a604 in _start ()

Did this work before? N/A 

Chrome version: 53.0.2785.143  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 23.0 r0
 
crash.pdf
1.0 MB Download
Project Member

Comment 1 by ClusterFuzz, Oct 11 2016

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=4807623247659008
Project Member

Comment 2 by ClusterFuzz, Oct 11 2016

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6436490970398720
Project Member

Comment 3 by ClusterFuzz, Oct 11 2016

ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6470043926003712

Comment 4 by mmoroz@chromium.org, Oct 11 2016

Components: Internals>Plugins>PDF
Mergedinto: 635565
Status: Duplicate (was: Unconfirmed)
Looks like a dupe of 635565.

I can reproduce the crash using an old revision (e.g. 408781), but cannot using the fresh one (e.g. 424378).
Project Member

Comment 5 by sheriffbot@chromium.org, Jan 17 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment