on 0.9.5 (the latest version) of podofo: there is an undefined behavior (memcpy with null pointer) in PdfMemoryOutputStream::Write function (src/base/PdfOutputStream.cpp), which can cause denial of service (crash) or possibly other unspecified impacts via a crafted pdf file.
src/base/PdfOutputStream.cpp:124:48: runtime error: null pointer passed as argument 2, which is declared to never be null To reproduce the issue, compile podofo with UBSAN "-fsanitize=undefined", then execute: podofoimgextract $POC OUTPUT_DIR The POC is attached.
podofo_0-9-5_podofoimgextract_undefined-behavior_PdfMemoryOutputStream-Write.pdf
Description: Adobe PDF document
------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________ Podofo-users mailing list Podofo-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/podofo-users
