0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

pdfium - opj_jp2_apply_pclr (libopenjpeg) Heap Based Out-of-Bounds Read

Author

Google Security Research

Risk

[

Security Risk Medium

]

0day-ID

Category

Date add

Platform

Source: https://code.google.com/p/google-security-research/issues/detail?id=626
 
The following crash was encountered in pdfium (the Chrome PDF renderer) during PDF fuzzing:
 
--- cut ---
==9326==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250001bf680 at pc 0x000000892375 bp 0x7ffca7393ea0 sp 0x7ffca7393e98
READ of size 4 at 0x6250001bf680 thread T0
    #0 0x892374 in opj_jp2_apply_pclr third_party/pdfium/third_party/libopenjpeg20/jp2.c:1018:18
    #1 0x88d536 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1512:5
    #2 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #3 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #4 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #5 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #6 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #7 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #8 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #9 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #10 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #11 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #12 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #13 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #14 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #15 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #16 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #17 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #18 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #19 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #20 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #21 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #22 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5
0x6250001bf680 is located 0 bytes to the right of 9600-byte region [0x6250001bd100,0x6250001bf680)
allocated by thread T0 here:
    #0 0x4b0154 in __interceptor_calloc
    #1 0x88219f in opj_j2k_update_image_data third_party/pdfium/third_party/libopenjpeg20/j2k.c:8157:57
    #2 0x8817d7 in opj_j2k_decode_tiles third_party/pdfium/third_party/libopenjpeg20/j2k.c:9603:23
    #3 0x869d57 in opj_j2k_exec third_party/pdfium/third_party/libopenjpeg20/j2k.c:7286:41
    #4 0x869d57 in opj_j2k_decode third_party/pdfium/third_party/libopenjpeg20/j2k.c:9796
    #5 0x88d234 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1483:8
    #6 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #7 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #8 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #9 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #10 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #11 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #12 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #13 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #14 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #15 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #16 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #17 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #18 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #19 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #20 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #21 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #22 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #23 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #24 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #25 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #26 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5
 
SUMMARY: AddressSanitizer: heap-buffer-overflow (pdfium_test+0x892374)
Shadow bytes around the buggy address:
  0x0c4a8002fe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002feb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a8002fec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a8002fed0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fee0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002fef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a8002ff20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==9326==ABORTING
--- cut ---
 
The crash was reported at https://code.google.com/p/chromium/issues/detail?id=554172. Attached is a PDF file which triggers the crash.
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39321.zip

#  0day.today [2024-12-23]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

pdfium - opj_jp2_apply_pclr (libopenjpeg) Heap Based Out-of-Bounds Read

Report Error

Report Error