Re: [Podofo-users] PoDoFo PdfString::Write buffer overflow

[Matthew Brincke]

Hello Mark, hello all,
> On 20 April 2018 at 00:09 Mark Rogers  wrote: 
> 
> 
> Hi 
> 
> 
> This code from PdfString::Write has a buffer overflow – it checks 
> buffer.GetSize() > 0 then sets nInputBufferLen=GetSize()-2 which is passed 
> to new[nInputBufferLen] and memcpy 

I'd like to contribute a fix for this (UTC tomorrow, I need to sleep soon):
> if( pEncrypt && m_buffer.GetSize() && IsValid() ) 

As IsValid() contains only a NULL check on the buffer in m_buffer,
the size check needs to be > 2 if ...
> { 
>   pdf_long nInputBufferLen = m_buffer.GetSize() - 2; // Cut off the trailing 
> pair of zeros 
there is to be a trailing-zero pair at all ...
Otherwise only when there is such a pair expected: should be the Unicode case.
I mean IMHO only then should there be one, I'm going to make it so too.
In the non-Unicode case I'll check if zero-termination is needed altogether,
if it isn't the check wouldn't need to be changed, but the handling would.

>   pdf_long nUnicodeMarkerOffet = sizeof( PdfString::s_pszUnicodeMarker ); 
Of course I'd correct the typo also.

> 
> Best Regards 
>
> Mark 
> 

Best regards, mabri

P.S. Please still hold off with the rc2 for a bit (@Dominik), I'd like to 
commit Francesco Pretto's iterator API addition (13/13) and a PdfPage one 
of my own, still before the rc2 (and shouldn't the known vulnerabilities
be fixed in it also?).

--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
Podofo-users mailing list
Podofo-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/podofo-users

Re: [Podofo-users] PdfParser unit tests

[Dominik Seichter via Podofo-users]

Hi Mark,

Thanks for this amazing test suite! I know, it is only a start for the huge
complex PdfParser, but I think it is a very good start. I included the
tests in the build with revision 1926.

They were running fine for me on Linux with the latest changes für #6 and
#7. I just had to include  and change due to new MaxObjectCount.

Best regards,
 Dominik

On Wed, Apr 18, 2018 at 7:52 PM, Mark Rogers 
wrote:

> Hi
>
>
>
> Here are the unit tests for PoDoFo::PdfParser I’ve been working on. I’ve
> just included the .cpp and .h files rather than a patch since they’re new
> files.
>
>
>
> I’ve not included a patch for CMakeLists.txt  – but I think all that’s
> needed is adding ParserTests.cpp to the CMakeLists.txt file for the unit
> tests (CppUnit takes care of everything else)
>
>
>
> What’s tested:
>
>- CVE-2017-8053, CVE-2015-8981, CVE-2017-5853, CVE-2018-5296
>CVE-2017-8787, CVE-2018-5295 CVE-2017-8378
>- Stress testing of ReadXRefSubsection( nFirstObject, nNumObjects )
>with lots of different values for nFirstObject and nNumObjects
>- Stress testing of ReadXRefSubsection with different values supplied
>to PdfParser::SetMaxObjectCount
>- Testing other PdfParser functions for infinite recursion,
>out-of-memory handling etc
>- See comments in ParserTests.h
>- 2k lines of code but still lots more that can be tested…
>
>
>
> Test results
>
>- Stack overflow in ReadXRefContents and ReadXRefStreamContents see
>https://sourceforge.net/p/podofo/tickets/7/
>
>- If this is patched (I have a patch) then the tests run successfully
>on Windows 10 with VC++ 2015 and macOS 10.11 with XCode 8/Clang and
>AddressSanitizer enabled
>- There’s a problem on macOS 10.13 (a SIGKILL when allocating a lot of
>memory) but it’s probably a macOS problem (10.13 is very buggy)
>
>
>
> Not tested:
>
>- Win64 build
>- Linux with GCC - might need a small change to get low memory tests
>to work – see comment in canOutOfMemoryKillUnitTests() at end of
>ParserTests.cpp
>
>
>
> Best Regards
>
> Mark
>
>
>
> --
>
> Mark Rogers - mark.rog...@powermapper.com
>
> PowerMapper Software Ltd - www.powermapper.com
>
> Registered in Scotland No 362274 Quartermile 2 Edinburgh EH3 9GL
>
>
>
> 
> --
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> ___
> Podofo-users mailing list
> Podofo-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/podofo-users
>
>
--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot___
Podofo-users mailing list
Podofo-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/podofo-users

Re: [Podofo-users] Check for preventing signatures from decryption not sufficient

[zyx]

On Tue, 2018-04-24 at 10:44 +0200, F. E. wrote:
> But I find it unacceptable to not even get a reply or
> acknowlegment from ANYONE, to be ignored entirely!

Hi,
I'm sorry, that's my fault. I've your previous message still marked as
"to-be-done", but I changed my mind, I think it is risky to make such
change just before the release. I didn't bother to let you know, for
which I apologize.

> I have a related issue with a certain pdf file, which still cannot be
> loaded.

I didn't look into your PDF, neither I'd find time any time soon, I'm
afraid. But if nobody is quicker, I'll check it in time of review &
test of your patch. Whether certain key should or should not be
encrypted declares the PDF standard. It's just about to find out it
there.
Bye,
zyx

--
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
___
Podofo-users mailing list
Podofo-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/podofo-users