Skip to content

Stack-overflow-GString-resize #4

@Aurorainfinity

Description

@Aurorainfinity

$ ./pdftohtml 01-Stack-overflow-GString-resize.pdf

==53770==ERROR: AddressSanitizer: stack-overflow on address 0x7fff8f17dff8 (pc 0x7f1188c9c2b4 bp 0x000006404890 sp 0x7fff8f17e000 T0)
    #0 0x7f1188c9c2b3  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xb02b3)
    #1 0x7f1188c9bd67  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xafd67)
    #2 0x7f1188c0ef4f  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22f4f)
    #3 0x7f1188c8567e in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9967e)
    #4 0x4a6d16 in GString::resize(int) (/home/test/pdftohtml_tmp/src/pdftohtml+0x4a6d16)
    #5 0x4a614e in GString::GString(GString*) (/home/test/pdftohtml_tmp/src/pdftohtml+0x4a614e)
    #6 0x41df3a in GString::copy() ../goo/GString.h:38
    #7 0x43c699 in Object::copy(Object*) /home/test/pdftohtml_tmp/xpdf/Object.cc:78
    #8 0x43c776 in Object::fetch(XRef*, Object*) /home/test/pdftohtml_tmp/xpdf/Object.cc:106
    #9 0x41faa7 in Dict::lookup(char*, Object*) /home/test/pdftohtml_tmp/xpdf/Dict.cc:76
    #10 0x41447f in Object::dictLookup(char*, Object*) (/home/test/pdftohtml_tmp/src/pdftohtml+0x41447f)
    #11 0x410a9e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:1943
    #12 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #13 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #14 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #15 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #16 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #17 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #18 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #19 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #20 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #21 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #22 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #23 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #24 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #25 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #26 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008
    #27 0x410f8e in HtmlOutputDev::newOutlineLevel(_IO_FILE*, Object*, Catalog*, int) /home/test/pdftohtml_tmp/src/HtmlOutputDev.cc:2008

ref:https://github.com/Aurorainfinity/Poc/tree/master/pdftohtml
01-Stack-overflow-GString-resize.pdf

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions