Issue metadata
Sign in to add a comment
|
pdfuim CPDF_HintTables::ReadSharedObjHintTable Memory Corruption
Reported by
riusks...@gmail.com,
Oct 11 2016
|
||||||||||||||||||||||
Issue description
UserAgent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
Steps to reproduce the problem:
open crash.pdf with chrome browser
What is the expected behavior?
process crash
What went wrong?
(2e00.1c1c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=10122a07 edx=00000000 esi=00000016 edi=00000008
eip=10122a07 esp=0043e410 ebp=0043e464 iopl=0 nv up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Google\Chrome\Application\53.0.2785.143\chrome_child.dll -
chrome_child!ChromeMain+0x73d888:
10122a07 c7050000000037130000 mov dword ptr ds:[0],1337h ds:0023:00000000=????????
the pdfuim_test stack backtrack in linux:
Stopped reason: SIGABRT
0x00007ffff6bf3cc9 in __GI_raise (sig=sig@entry=0x6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
gdb-peda$ bt
#0 0x00007ffff6bf3cc9 in __GI_raise (sig=sig@entry=0x6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff6bf70d8 in __GI_abort () at abort.c:89
warning: Could not find DWO CU obj/fpdfapi/cpdf_hint_tables.dwo(0xd87bd21a37e73042) referenced by CU at offset 0xadb1db [in module /root/pdfuim/pdfium_test]
#2 0x0000000000dc5840 in int pdfium::base::checked_cast<int, unsigned int>(unsigned int) ()
at ../../third_party/base/numerics/safe_conversions.h:29
#3 0x0000000000dc4947 in CPDF_HintTables::ReadSharedObjHintTable(CFX_BitStream*, unsigned int) ()
at ../../core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:305
#4 0x0000000000dc5275 in CPDF_HintTables::LoadHintStream(CPDF_Stream*) ()
at ../../core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:447
warning: Could not find DWO CU obj/fpdfapi/cpdf_data_avail.dwo(0x66d30f6a2be205eb) referenced by CU at offset 0xadb13f [in module /root/pdfuim/pdfium_test]
#5 0x0000000000db0a5f in CPDF_DataAvail::CheckHintTables(CPDF_DataAvail::DownloadHints*) ()
at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:779
#6 0x0000000000daf7d0 in CPDF_DataAvail::CheckDocStatus(CPDF_DataAvail::DownloadHints*) ()
at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:276
#7 0x0000000000daf717 in CPDF_DataAvail::IsDocAvail(CPDF_DataAvail::DownloadHints*) ()
at ../../core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:213
warning: Could not find DWO CU obj/pdfium/fpdf_dataavail.dwo(0xe654fb90a2de2565) referenced by CU at offset 0xada8d3 [in module /root/pdfuim/pdfium_test]
#8 0x0000000000d2186c in FPDFAvail_IsDocAvail () at ../../fpdfsdk/fpdf_dataavail.cpp:129
#9 0x0000000000411726 in RenderPdf(std::string const&, char const*, unsigned long, Options const&, std::string const&) () at ../../samples/pdfium_test.cc:652
#10 0x000000000041213e in main () at ../../samples/pdfium_test.cc:878
#11 0x00007ffff6bdeec5 in __libc_start_main (main=0x411c40 <main>, argc=0x2, argv=0x7fffffffe3c8,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe3b8)
at libc-start.c:287
#12 0x000000000040a604 in _start ()
Did this work before? N/A
Chrome version: 53.0.2785.143 Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 23.0 r0
,
Oct 11 2016
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6436490970398720
,
Oct 11 2016
ClusterFuzz is analyzing your testcase. Developers can follow the progress at https://cluster-fuzz.appspot.com/testcase?key=6470043926003712
,
Oct 11 2016
Looks like a dupe of 635565. I can reproduce the crash using an old revision (e.g. 408781), but cannot using the fresh one (e.g. 424378).
,
Jan 17 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by ClusterFuzz
, Oct 11 2016