-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello.

On 28.07.2011 14:40, David Stroud wrote:
> The above code, when compressed with rle, flate and ahex (singularly or
> stacked), works with no problems (on adobe reader 8). However, as soon as I
> introduce lzw into it, either on it's own or stacked with one or all the
> others, the exploit doesn't trigger. I tried the code without any whitespace
> as well, but no luck there either.

At the moment I am doing a review of the lzw filter and found a bug that
sometimes causes an additional unspecified 0 byte at the end of the
encoded lzw stream (patch attached).

Maybe this caused your problem (I have not reproduced it). Please send
me the corrupt PDF or encoded lzw-buffer so that I can debug the
decoding process with the same input.

Regards,
Georg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk45GCQACgkQ5sLITM1qIaJxSQCeJNuFWC0mmNh9gONp/LsS072m
QWkAn0KH562195x+d0LrtQ6R9V5rtp1k
=SBmU
-----END PGP SIGNATURE-----
# Bazaar merge directive format 2 (Bazaar 0.90)
# revision_id: georg.gottleu...@uni-ulm.de-20110803092132-\
#   8fl0e5itfg4b968r
# target_branch: bzr://bzr.sv.gnu.org/pdf/libgnupdf/trunk/
# testament_sha1: 810eb3f529e2c3a3cb377414b7b68ff11b5c1d6c
# timestamp: 2011-08-03 11:21:56 +0200
# base_revision_id: jema...@gnu.org-20110801200358-qc0dhdf3hs44lljv
# 
# Begin patch
=== modified file 'src/base/pdf-stm-f-lzw.c'
--- src/base/pdf-stm-f-lzw.c    2011-05-19 17:21:16 +0000
+++ src/base/pdf-stm-f-lzw.c    2011-08-03 09:21:32 +0000
@@ -442,6 +442,10 @@
       lzw_buffer_put_code (&st->buffer, LZW_EOD_CODE);
       lzw_buffer_put_code (&st->buffer, 0); /* flush */
 
+      /* delete 0 byte if buffer was already aligned before flush */
+      if (out->data[out->wp - 1] == 0x0)
+        out->wp--;
+
       st->really_finish = PDF_TRUE;
 
       return (pdf_buffer_full_p (out) ?

# Begin bundle
IyBCYXphYXIgcmV2aXNpb24gYnVuZGxlIHY0CiMKQlpoOTFBWSZTWcZRVNoACJZ/gFfxQAB7d///
///fvr////5gDW+O82tmdAHQAA6AyiFdV0ADqgFEgBCUJJHkQepp5JkBtQeoAANA009IAAAAGQ5k
00MgAYjIMgBpggYgGjTQAZA0ADJTZCCaj00npTaANTaNQaAYRkegJgIDCA2oEmpUyFPIymJiafqm
jJkAJsITJgAACYCPUb1NBzJpoZAAxGQZADTBAxANGmgAyBoAEkQTQAmgmCDU0yZNJlT9BMU/RR6n
qeoB6Q9Q0yNG1D9ABAVPVTLWLnJZLYxJKqyM/AYmdWgtOafcGQ+xeM0YVzpSY8SL/uyPLLMyHYhk
efj5Zl2p2KVu0R6neD5h+egVZKoZoeiTJWDJekrNzwao1hWv7gf3QHfU49kZ5WwQM2dCNumcbMRC
rZAsaDJrJNNn0dhArI8TiaKPdJBIPiGQTyvYRjeAJBLiCRsoTsJAyMlkYxZx6mFgWfH6HGMEsx/3
eD4zkXvk2vX/3mW35jy0H+dqbE3ZNomrFjILFBVBSKoT/fPWgMuJx/6rIjQG5MkzHXN2eMeuU+3n
9loPXPuSLSszkMonECYCLOeiumaLBlR5DnoVSChzg5XQ8rZkiQPKcGZ2XLYbUtQxUl+jdaZmh0VU
9Y1NfaXSixNkrZC/TYFVQ00WHclFhZQ01+pHSxpvmqRcYz6cD6RVB5aGVfyRkW4xE/dWWHmuEvxy
OirsQlmEKA37sDGw2qDZC1TQy4VXJhqy4SVkaiSd4SZoE2RdBMulASmrabtcaWQKR2b8dXGIf1dv
f3+Hrh7PYHiS2foze1S/2TUfvNZJmGey3lgbMzpyOsFba4hfgwHwqUooU6bIm8vGio8qx6EWuNHU
0nMG7cqbIJNQQR0Clrb6t0VjIkSJG+np3X4H8STDnrIHWQCwVhYwfrEUEgZMC+oJoDaHgv2ea8v5
egveRKwCUfcWWLzS1DBL0OwQFndS3yPoYYYMRAbKtYgG2IOr3oW9fh+I3tZ/yIpXWjb9vJO7hzJS
OoNOdaEde55MobnAiyDixJkiRV9cIHaUX80EDpB2u4hFaeg1gxYut7vqqSd6BHEqmEUouCawrVna
RmEdUMAgkwM6r4HSLSAcRJCHSRi6GoDqKTAoNjFZFYKOBMCYmUEXjGIRxwIuRX0golxJOcztANeK
lmEEBfBhwvi+DFjEAJ3nmlhUnFo33SGWKiSCxZImUNLPMe2V7b9zQScdkkHUPlVKCoVl9plfO1XP
OdYBJtCNsY2zmUIyuxIAthIKy8xHLnSLZVhfGHiZH2TwkxmitgCFfUbMIO8Cn30xbbaa+caRV2mk
g0SxqMC4ltGHM/swOrjWY7FcHVk4ZErXGi9+LSLUogqSkG1AUPW6BFySqDRb1oaXpV4ADltwK9sY
NcEghTqvnSDkGwCrcVUQHWVWbjqkC/ge5mGYZF+NxUXc95INC7B6XaMW6nY0zreoqjqjSRTF0oIr
T2B6rIAqq2pfxrCuQK8KRrYgva4XjVOEyGCdb7i+bmlxqHqgHRjG5yR2Z4UJFuRcOxraJwNCu49Q
VLT9b9GNxjZMsi5O7lAlKZJIomqoEMX1kq2DbW7NURaw9auC3IpzIFWF/qU9MJwMccQ3cuGyQcED
Y1Fx6AquFQXKMA3QMEai0se2OuZJTmXahSwJGmoGSVhaRpa4blQ4SCk6qYxfBNKT1g1pL5usZmsx
Ta6yzAbI2THsLTZEGBXmvXnm76mr11ZFLTAzkTQDZ0tJ4F1lHuN2GBgfqlhhdOtgVNpQwNRmZCKi
sewxMKyh82hA8NZaXpVlKriq1ytGpi9bYQgETISRDAGuiNDyktTxKHsHXa5ETMd8LNRathRIgMan
L2Kg1E0ty6uQBneYBbB3rhfZhmwawYRWDApka8o6HLXtkbC96yF12+NJEiBi1Q9sS7ustLcByazo
RsLdhuNRfNyzDcazrBdSwBODQzqsWeFs4WvMHAI1OMaHJ6x69pGcgTdVRkiW68rUjaSTgtpeSyK8
Sl8NhBI4uPYVG4pCo3bFM1FC0pMqNAC4LfM+AeCZbenn543mCWQ2thMm4jG2IxBIeRvQ6CHdMikJ
gG/AwhMOAS9qZDrm88gztOS21ivUk14nb9g3loZUVWKpOebc0UEQuCmKJdKQaCZEhD+B9SWcBiK9
/DmL6UwgIgfw+4Qv0PP58ITUymQNRRUQYq8H3hbwRmapTEGIIKMMBkm0eZzK1TQaB+cIWDkz+AgZ
gtxR4mKmqqqqlrNpyAf+Bm3dAHPADFDOM6BmgyxrnT86L7TqcP24HFHJICsQpezRxeQCv/kmQLRj
UkBqmgmiPUT1CDrRG5FYhR0rKkyr1otDsLQ/BW1GgXoUAkXJAUGVhF0NYIVV5UGQhVJAZHWFQWjK
5BzQTusdB9cl/H2zyWenMQ2dYulokJYQmOFYAp6geYQuFOqMc8hJwTravt84CXmJU+GuDe8+82FE
j5Mk4fcfIwRjfLDVx4sVyiAUYCcZOnbqBCbEyBEKibbxCcOGmL6jE3grJpXpb/u1IB/xDID5RKyS
LBcUEHcgOKXEkSCE5O8BUrKQmPSEJB+eikYp0FUmMUnn+J8tQb+hX+Xh3LwHO0idDaQOhEtK5msq
PAmCgFiL9bgsL0SEsBIFcopFLGccxMh+IUYgT+kBCgoB96cXSC7D2B3rLUYGzhv3anW7hsN+JQmQ
if6iMihxGkqI4MYTPHn5Han/wOfqNY57PzG/Ad0QgX0NxkrJly70zDDcOr3nT0I9Z1GBPzG7OsMy
B3BMwEQ4XpGB25GDlRA1WgESRif9/Pw3abi/Eg50PWklpLoQXA/9ZS1i8EvRWFm0iLRMgp6tpLS3
r9veHgNTyJLJkppe6E5/Nqdbu7Cw5pJWpd28Y4mdVfGlRmQUfL1v+2PQtK+IKhceB4EyZ86W9J1i
GTMxsGHzNEmBbersZL2GZuKU8eTbbdDeYHe5uwN2rEs4OfRlsIs2RmKykzXwcvj7CAWLQP9PpXrt
BdwmSP7QmIDTNmGFuYCzrcjATCAcS5gx039kvE8SB+rEzfemEgzMkLglcAQqKw9jMYi/Y3AyPW8F
5wIkDYaDdxzO7mTZzsPd7rStBYNQfJB6QDWE5vDJ1pNWTTZEMQUdk3qqG9Ra6TxXqhG46YBznFTN
oZjneHYlUmBmNbP2DotBwdIRoBNi2XomuIhGG+ckGYyCVBCtWZZsBd3oILiIC0Xb39YOk4gY+QyU
FPanugHvD5yKOIcFTuEAyFrEBJfFLmbZZb+b0Ow+IAxYe8M9EHPnZahGlBOADBUvE1go6VzvKmBM
errOoqJnBCZd1WDfMhY9oJpG3FcbEsuiXNc16AGa8gCa5ngu95hxS7DsAPQOQLE6CtSWoE4EEKA5
uSYTjFdwkQcUOAkFkIsyZCkcRw+K9gIKBcLkSqRGQ4AUIhfbvKXRPIlUICAA9iqRQDx3FoTJBLkc
TjAqQZ9DiGIwCgjA7IaIGEmRtCJG3jpbiTp7dX7YjKpBtEBtGJRCMkBYIGZIsQOKGvw5SWw2Yxgk
oWr5HUHJLsL0lL4EhVRTj/BZjliS45ag5IGEA6PEOkxfkvgrPiG0QHH/77OGype1mzN0vWXDJ0Kk
OVe33dKURcMDAWgGwHGrcAOIWz0yzUNrtgzWDcuDn6IaW5ytwZNFESoICCGoA7nSQsMwXYP30UlJ
m75pQK6E0I2HwOKDWlYEgGSEMgp8OcCKNAli08iPUTCSaYwumqtxzzWQaBvTU2AG49wriVoLZrMX
RrGDRLFCZL3l50ZDMGdQXJ0AxYQ/fyLUL6ImHYyoVmOQycbVswqKBNLenEoTSDRrNXUpk7gCwYA1
CTFYKaaCLwmRvLYoyCuZenEgwmFZrEpYqIKQq+mNI213QSPhisRINsUFhmYCQRc7DabBAaz6hAXn
p9YBsz9RbuzCwPE2n7o6B3K5fz7Co0D1BbuFJC+1KST/EMWHofqxrb5Dcl7vrDD0CsSKHZyN/aOG
nrUSu6J3hetneerkr+ADKYidoN0GcE06/VhSih+xdyRThQkMZRVNoA==

Reply via email to