There is an integer overflow on the MuPDF in the lex_number() function which can be triggered using a corrupt PDF file with ObjStm.
I'm attaching a file that reproduces the problem with the original unmodified file. The ObjStm was modified to include big numbers.
The easy way to fix is to update to the latest version of MuPDF library.
Flaw details
-===========
On the FIXME line occurs an integer overflow, which can be later abused to
write to memory:
File: pdf_lex.c
static int lex_number(fz_stream *f, pdf_lexbuf *buf, int c)
{
.....
while (1)
{
int c = fz_read_byte(f);
switch (c)
{
case '.':
goto loop_after_dot;
case RANGE_0_9:
i = 10*i + c - '0';
/* FIXME: Need overflow check here; do we care? */
break;
default:
fz_unread_byte(f);
/* Fallthrough */
case EOF:
if (neg)
i = -i;
buf->i = i;
return PDF_TOK_INT;
}
}
....
file: pdf_repair.c
static void pdf_repair_obj_stm(pdf_document *xref, int num, int gen)
{
....
for (i = 0; i < count; i++)
{
tok = pdf_lex(stm, &buf);
if (tok != PDF_TOK_INT)
fz_throw(ctx, "corrupt object stream (%d %d R)",
num, gen);
n = buf.i; // n can take negative values when an integer
overflow occurs
if (n >= xref->len)
pdf_resize_xref(xref, n + 1);
POC
-===
Attached proof of concept.
http://www.exploit-db.com/sploits/23246.tar.gz
!Exploitable output
-==================
MuPDF:
Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at
mupdf+0x000000000003e1a6 (Hash=0x0e1a1f61.0x5f702654)
User mode write access violations that are not near NULL are exploitable.
Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at
ntdll32!ZwRaiseException+0x0000000000000012
(Hash=0x16621b14.0x14396738)
User mode write access violations that are not near NULL are exploitable.
