CVE-2019-9545: Recursive function call in function JBIG2Stream::readTextRegion()

Recursive function call in function JBIG2Stream::readGenericBitmap() – poppler 0.74.0

Loginsoft-2019-1100

28 February, 2019

CVE Number

CVE-2019-9545

CWE

CWE - 20 : Improper Input Validation

Product Details

Poppler is a free software utility library for rendering Portable Document Format documents.URL:https://gitlab.freedesktop.org/poppler/poppler/

Vulnerable Versions

0.74.0

Vulnerability Details

During our research there is a recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc in poppler 0.74.0. The same be triggered by sending a crafted pdf file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

SYNOPSIS

In Progress

Vulnerable Source code


JBIG2Stream::readTextRegion()

Analysis

DEBUG:

GDB :


[ Legend: Modified register | Code | Heap | Stack | String ]
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ registers ]────
$rax : 0x7fff8cf5c800 → 0x0000000000000000
$rbx : 0x3be980 
$rcx : 0x7fff8cff5000 → 0x0000000000000000
$rdx : 0x7fff8d31b180 → 0x0000000000000000
$rsp : 0x7fffffffc158 → 0x00007ffff6e78cdf → mov rcx, QWORD PTR [rbp-0x38]
$rbp : 0x7fffffffc9e0 → 0x00007fffffffca00 → 0x00007fffffffcdb0 → 0x00007fffffffd3b0 → 0x00007fffffffd5f0 → 0x00007fffffffd620 → 0x00007fffffffd640 → 0x00007fffffffd740
$rsi : 0x0 
$rdi : 0x7fff8cf5c800 → 0x0000000000000000
$rip : 0x7ffff5b58963 →  movdqa XMMWORD PTR [rcx], xmm0
$r8 : 0x1000719e3900 → 0x0000000000000000
$r9 : 0x100071a5b630 → 0xfafafafafafafa01
$r10 : 0x4032 
$r11 : 0x202 
$r12 : 0x7fff8cf5c800 → 0x0000000000000000
$r13 : 0x7fff8d31b180 → 0x0000000000000000
$r14 : 0x0 
$r15 : 0x0 
$eflags: [zero carry parity adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$fs: 0x0000 $gs: 0x0000 $ds: 0x0000 $cs: 0x0033 $es: 0x0000 $ss: 0x002b 
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ stack ]────
0x00007fffffffc158│+0x00: 0x00007ffff6e78cdf → mov rcx, QWORD PTR [rbp-0x38] ← $rsp
0x00007fffffffc160│+0x08: 0x00007ffff6726e6f →  mov QWORD PTR [rbp-0x2d8], r14
0x00007fffffffc168│+0x10: 0x00007ffff6722a77 →  add rsp, 0xb0
0x00007fffffffc170│+0x18: 0x00007ffff671f5a2 →  xor eax, 0x1
0x00007fffffffc178│+0x20: 0x00007ffff671e351 →  mov rax, QWORD PTR [rbp-0x18]
0x00007fffffffc180│+0x28: 0x00007ffff6609541 →  nop 
0x00007fffffffc188│+0x30: 0x00007ffff673bee2 →  nop 
0x00007fffffffc190│+0x38: 0x00007ffff66354eb → 0x00000040bfe6894d → 0x0000000000000000
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ code:i386:x86-64 ]────
0x7ffff5b5895a  and rdx, 0xffffffffffffffc0
0x7ffff5b5895e  cmp rcx, rdx
0x7ffff5b58961  je 0x7ffff5b58923 
→ 0x7ffff5b58963  movdqa XMMWORD PTR [rcx], xmm0
0x7ffff5b58967  movdqa XMMWORD PTR [rcx+0x10], xmm0
0x7ffff5b5896c  movdqa XMMWORD PTR [rcx+0x20], xmm0
0x7ffff5b58971  movdqa XMMWORD PTR [rcx+0x30], xmm0
0x7ffff5b58976  add rcx, 0x40
0x7ffff5b5897a  cmp rdx, rcx
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ threads ]────
[#0] Id 1, Name: "pdfimages", stopped, reason: SIGINT
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ trace ]────
[#0] 0x7ffff5b58963 → Name: __memset_sse2_unaligned_erms()
[#1] 0x7ffff6e78cdf → mov rcx, QWORD PTR [rbp-0x38]
[#2] 0x7ffff671b455 → Name: JBIG2Bitmap::clearToZero(this=0x60300001b400)
[#3] 0x7ffff6726f27 → Name: JBIG2Stream::readTextRegion(this=0x612000000f40, huff=0x0, refine=0x1, w=0x95e, h=0x3320, numInstances=0x5, logStrips=0x0, numSyms=0x3d0, symCodeTab=0x0, symCodeLen=0xe, syms=0x633000000800, defPixel=0x0, combOp=0x0, transposed=0x0, refCorner=0x1, sOffset=0x0, huffFSTable=0x7ffff6de4de0 , huffDSTable=0x7ffff6de5020 , huffDTTable=0x7ffff6de54c0 , huffRDWTable=0x7ffff6de5840 , huffRDHTable=0x7ffff6de5840 , huffRDXTable=0x7ffff6de5840 , huffRDYTable=0x7ffff6de5840 , huffRSizeTable=0x7ffff6de4aa0 , templ=0x0, atx=0x7fffffffd280, aty=0x7fffffffd2c0)
[#4] 0x7ffff6722a77 → Name: JBIG2Stream::readSymbolDictSeg(this=0x612000000f40, segNum=0x0, length=0x2e2e2e2e, refSegs=0x0, nRefSegs=0x0)
[#5] 0x7ffff671f5a2 → Name: JBIG2Stream::readSegments(this=0x612000000f40)
[#6] 0x7ffff671e351 → Name: JBIG2Stream::reset(this=0x612000000f40)
[#7] 0x7ffff6609541 → Name: Object::streamReset(this=0x610000001658)
[#8] 0x7ffff673bee2 → Name: Lexer::Lexer(this=0x610000001640, xrefA=0x6120000001c0, obj=0x7fffffffd910)
[#9] 0x7ffff66354eb → Name: Gfx::display(this=0x612000000ac0, obj=0x7fffffffd910, topLevel=0x1)

Proof of Concept

pdfimages -f 1 -l 1 -opw testing -upw testing -j -p –q $POC output

Timeline

‍Vendor Disclosure: 2019-3-1

Public Disclosure:2019-3-2

Credit

Discovered by ACE Team - Loginsoft