Stack-overflow-GString-resize

[Aurorainfinity]

$ ./pdftohtml 01-Stack-overflow-GString-resize.pdf

==53770==ERROR: AddressSanitizer: stack-overflow on address 0x7fff8f17dff8 (pc 0x7f1188c9c2b4 bp 0x000006404890 sp 0x7fff8f17e000 T0)
    #0 0x7f1188c9c2b3  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xb02b3)
    #1 0x7f1188c9bd67  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xafd67)
    #2 0x7f1188c0ef4f  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22f4f)
    #3 0x7f1188c8567e in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9967e)
    #4 0x4a6d16 in GString::resize(int) (/home/test/pdftohtml_tmp/src/pdftohtml+0x4a6d16)
    #5 0x4a614e in GString::GString(GString*) (/home/test/pdftohtml_tmp/src/pdftohtml+0x4a614e)
    #6 0x41df3a in GString::copy() ../goo/GString.h:38
    #7 0x43c699 in Object::copy(Object*) /home/test/pdftohtml_tmp/xpdf/Object.cc:78
    #8 0x43c776 in Object::fetch(XRef*, Object*) /home/test/pdftohtml_tmp/xpdf/Object.cc:106
    #9 0x41faa7 in Dict::lookup(char*, Object*) /home/test/pdftohtml_tmp/xpdf/Dict.cc:76
    #10 0x41447f in Object::dictLookup(char*, Object*) (/home/test/pdftohtml_tmp/src/pdftohtml+0x41447f)
    #11 0x410a9e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:1943
    #12 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #13 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #14 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #15 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #16 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #17 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #18 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #19 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #20 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #21 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #22 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #23 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #24 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #25 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #26 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #27 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008

ref:https://github.com/Aurorainfinity/Poc/tree/master/pdftohtml
01-Stack-overflow-GString-resize.pdf

[duncantl]

Thanks. I'll take a look. Are you using this version of pdftohtml for specific projects and running into these issues? Or is this a more abstract/general validation of the projects code? Both are good, just curious.
Thanks
Duncan

[duncantl]

3 of the 4 PDF files are "damaged". Is it really vital that this pdftohtml version fails gracefully on malformed PDF or is there a larger issue?

[Aurorainfinity]

There are no larger issue, just cause the program to collapse