oCERT-2008-007 libpoppler uninitialized pointer

Description:

The poppler PDF rendering library suffers a memory management bug which leads to arbitrary code execution.

The vulnerability is present in the Page class constructor/destructor. The pageWidgets object is not initialized in the Page constructor if specific conditions are met, but it is deleted afterwards in the destructor regardless of its initialization.

Specific PDF files can be crafted which allocate arbitrary memory to trigger the vulnerability.

A new poppler version addressing the issue is scheduled to be released on July 30th according to maintainer.

The following patch fixes the issue:

diff --git a/poppler/Page.cc b/poppler/Page.cc
index b28a3ee..72a706b 100644
--- a/poppler/Page.cc
+++ b/poppler/Page.cc
@@ -230,7 +230,7 @@ GBool PageAttrs::readBox(Dict *dict, char *key, PDFRectangle *box) {
 
 Page::Page(XRef *xrefA, int numA, Dict *pageDict, PageAttrs *attrsA, Form *form) {
   Object tmp;
-	
+  pageWidgets =	NULL;  //Security fix
   ok = gTrue;
   xref = xrefA;
   num = numA;

Affected version:

Poppler <= 0.8.4

Fixed version:

Poppler >= 0.8.5

Credit: vulnerability report, patch and PoC code received from Felipe Andres Manzano <fmanzano [at] fceia [dot] unr [dot] edu [dot] ar>.

CVE: CVE-2008-2950

Timeline:

2008-06-27: vulnerability report received
2008-06-28: contacted poppler maintainers and affected vendors
2008-06-30: maintainer confirms issue and patch
2008-07-07: advisory release
2008-07-28: libpoppler 0.8.5 released

References:
http://felipe.andres.manzano.googlepages.com/popplerPOC.tar.bz2
http://cgit.freedesktop.org/poppler/poppler/commit/?id=3696025977fd345b12767f75a2de6ed7e9467365