Stack-overflow in CPDF_ColorSpace::Load |
||||||
Issue descriptionDetailed report: https://clusterfuzz.com/testcase?key=5908975131557888 Fuzzer: lszekeres_pdf_small Job Type: linux_asan_pdfium Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffc9d7c1ea8 Crash State: CPDF_ColorSpace::Load CPDF_DocPageData::GetColorSpaceImpl CPDF_DocPageData::GetColorSpace Sanitizer: address (ASAN) Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5908975131557888 Issue filed automatically. See https://github.com/google/clusterfuzz-tools for more information.
,
Aug 28 2017
Over to Dan.
,
Aug 29 2017
hnakashima@ can you take a look?
,
Aug 30 2017
This is a crafty test case. The call cycle: - CPDF_DocPageData::GetColorSpace(A) - CPDF_DocPageData::GetColorSpaceImpl(A) - CPDF_ColorSpace::Load(A) - CPDF_ICCBasedCS::v_load(A) - CPDF_ICCBasedCS::FindAlternateProfile(A[1].dict) - CPDF_ColorSpace::Load(B) - CPDF_IndexedCS::Load(B) - CPDF_DocPageData::GetColorSpace(A) - back to beginning This happens when loading an Indexed color space A that uses an ICCBased color space B as "base", while B uses A as "Alternate" (fallback). One therefore depends on the other creating this 8-shaped stack overflow.
,
Aug 31 2017
The following revision refers to this bug: https://pdfium.googlesource.com/pdfium/+/ce9ad1bee792856c2d9e940ecffff97145e18d32 commit ce9ad1bee792856c2d9e940ecffff97145e18d32 Author: Henrique Nakashima <hnakashima@chromium.org> Date: Thu Aug 31 19:34:56 2017 Fix colorspace loading for mutually referencing colorspaces. For example, Indexed colorspace A uses ICC Based colorspace B as its "base". B declares A as its "Alternate" fallback. Bug: chromium:759012 Change-Id: I4b78e68b9a77456050ecae4452837495546bf93d Reviewed-on: https://pdfium-review.googlesource.com/12471 Commit-Queue: Henrique Nakashima <hnakashima@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_docpagedata.cpp [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_colorspace.cpp [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_patterncs.cpp [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_colorspace.h [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_docpagedata.h [modify] https://crrev.com/ce9ad1bee792856c2d9e940ecffff97145e18d32/core/fpdfapi/page/cpdf_patterncs.h
,
Aug 31 2017
,
Sep 2 2017
ClusterFuzz has detected this issue as fixed in range 499274:499353. Detailed report: https://clusterfuzz.com/testcase?key=5908975131557888 Fuzzer: lszekeres_pdf_small Job Type: linux_asan_pdfium Platform Id: linux Crash Type: Stack-overflow Crash Address: 0x7ffc9d7c1ea8 Crash State: CPDF_ColorSpace::Load CPDF_DocPageData::GetColorSpaceImpl CPDF_DocPageData::GetColorSpace Sanitizer: address (ASAN) Fixed: https://clusterfuzz.com/revisions?job=linux_asan_pdfium&range=499274:499353 Reproducer Testcase: https://clusterfuzz.com/download?testcase_id=5908975131557888 See https://github.com/google/clusterfuzz-tools for more information. If you suspect that the result above is incorrect, try re-doing that job on the test case report page.
,
Sep 2 2017
ClusterFuzz testcase 5908975131557888 is verified as fixed, so closing issue as verified. If this is incorrect, please add ClusterFuzz-Wrong label and re-open the issue.
,
Apr 2 2018
|
||||||
►
Sign in to add a comment |
||||||
Comment 1 by sandeepkumars@chromium.org
, Aug 28 2017Labels: Test-Predator-Wrong-CLs M-61
Owner: tsepez@chromium.org
Status: Assigned (was: Untriaged)