Commit message: Check for stream before calling stream methods when saving an embedded file.

Closes #659
CVE: CVE-2018-19058
CWE: CWE-670
Vulnerability description: An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

Project: poppler
File: FileSpec.cc

EmbFile *FileSpec::getEmbeddedFile()
{
  if(!ok)
    return nullptr;

  if (embFile)
    return embFile;

  Object obj1;
  XRef *xref = fileSpec.getDict()->getXRef();
  obj1 = fileStream.fetch(xref);
  embFile = new EmbFile(&obj1);

  return embFile;
}

Project: poppler
File: FileSpec.cc

FileSpec::~FileSpec()
{
  delete fileName;
  delete platformFileName;
  delete embFile;
  delete desc;
}

Project: poppler
File: FileSpec.cc

Object getFileSpecNameForPlatform (const Object *fileSpec)
{
  if (fileSpec->isString()) {
    return fileSpec->copy();
  }

  Object fileName;
  if (fileSpec->isDict()) {
    fileName = fileSpec->dictLookup("UF");
    if (!fileName.isString ()) {
      fileName = fileSpec->dictLookup("F");
      if (!fileName.isString ()) {
#ifdef _WIN32
	const char *platform = "DOS";
#else
	const char *platform = "Unix";
#endif
        fileName = fileSpec->dictLookup(platform);
	if (!fileName.isString ()) {
	  error(errSyntaxError, -1, "Illegal file spec");
	  return Object();
	}
      }
    }
  } else {
    error(errSyntaxError, -1, "Illegal file spec");
    return Object();
  }

  // system-dependent path manipulation
#ifdef _WIN32
  int i, j;
  GooString *name = fileName.getString()->copy();
  // "//...."             --> "\...."
  // "/x/...."            --> "x:\...."
  // "/server/share/...." --> "\\server\share\...."
  // convert escaped slashes to slashes and unescaped slashes to backslashes
  i = 0;
  if (name->getChar(0) == '/') {
    if (name->getLength() >= 2 && name->getChar(1) == '/') {
      name->del(0);
      i = 0;
    } else if (name->getLength() >= 2 &&
	       ((name->getChar(1) >= 'a' && name->getChar(1) <= 'z') ||
		(name->getChar(1) >= 'A' && name->getChar(1) <= 'Z')) &&
	       (name->getLength() == 2 || name->getChar(2) == '/')) {
      name->setChar(0, name->getChar(1));
      name->setChar(1, ':');
      i = 2;
    } else {
      for (j = 2; j < name->getLength(); ++j) {
        if (name->getChar(j-1) != '\\' &&
	    name->getChar(j) == '/') {
	  break;
	}
      }
      if (j < name->getLength()) {
        name->setChar(0, '\\');
	name->insert(0, '\\');
	i = 2;
      }
    }
  }
  for (; i < name->getLength(); ++i) {
    if (name->getChar(i) == '/') {
      name->setChar(i, '\\');
    } else if (name->getChar(i) == '\\' &&
	       i+1 < name->getLength() &&
	       name->getChar(i+1) == '/') {
      name->del(i);
    }
  }
  fileName = Object(name);
#endif /* _WIN32 */

  return fileName;
}

Project: poppler
File: FileSpec.cc

EmbFile::~EmbFile()
{
  delete m_createDate;
  delete m_modDate;
  delete m_checksum;
  delete m_mimetype;
}

Project: poppler
File: FileSpec.cc

GooString *FileSpec::getFileNameForPlatform()
{
  if (platformFileName)
    return platformFileName;

  Object obj1 = getFileSpecNameForPlatform(&fileSpec);
  if (obj1.isString())
    platformFileName = obj1.getString()->copy();

  return platformFileName;
}

Project: poppler
File: FileSpec.cc

bool EmbFile::save(const char *path) {
  FILE *f;
  bool ret;

  if (!(f = fopen(path, "wb"))) {
    return false;
  }
  ret = save2(f);
  fclose(f);
  return ret;
}

Project: poppler
File: FileSpec.cc

bool EmbFile::save2(FILE *f) {
  int c;

  if (unlikely(!m_objStr.isStream()))
    return false;

  m_objStr.streamReset();
  while ((c = m_objStr.streamGetChar()) != EOF) {
    fputc(c, f);
  }
  return true;
}

Project: poppler
File: FileSpec.cc

EmbFile::EmbFile(const Object *efStream)
{
  m_size = -1;
  m_createDate = nullptr;
  m_modDate = nullptr;
  m_checksum = nullptr;
  m_mimetype = nullptr;

  m_objStr = efStream->copy();

  if (efStream->isStream()) {
    // dataDict corresponds to Table 3.41 in the PDF1.6 spec.
    Dict *dataDict = efStream->streamGetDict();

    // subtype is normally the mimetype
    Object subtypeName = dataDict->lookup("Subtype");
    if (subtypeName.isName()) {
      m_mimetype = new GooString(subtypeName.getName());
    }

    // paramDict corresponds to Table 3.42 in the PDF1.6 spec
    Object paramDict = dataDict->lookup("Params");
    if (paramDict.isDict()) {
      Object paramObj = paramDict.dictLookup("ModDate");
      if (paramObj.isString())
        m_modDate = new GooString(paramObj.getString());

      paramObj = paramDict.dictLookup("CreationDate");
      if (paramObj.isString())
        m_createDate = new GooString(paramObj.getString());

      paramObj = paramDict.dictLookup("Size");
      if (paramObj.isInt())
        m_size = paramObj.getInt();

      paramObj = paramDict.dictLookup("CheckSum");
      if (paramObj.isString())
        m_checksum = new GooString(paramObj.getString());
    }
  }
}

Project: poppler
File: FileSpec.cc

Object getFileSpecName (const Object *fileSpec)
{
  if (fileSpec->isString()) {
    return fileSpec->copy();
  }
  
  if (fileSpec->isDict()) {
    Object fileName = fileSpec->dictLookup("UF");
    if (fileName.isString()) {
      return fileName;
    }
    fileName = fileSpec->dictLookup("F");
    if (fileName.isString()) {
      return fileName;
    }
    fileName = fileSpec->dictLookup("DOS");
    if (fileName.isString()) {
      return fileName;
    }
    fileName = fileSpec->dictLookup("Mac");
    if (fileName.isString()) {
      return fileName;
    }
    fileName = fileSpec->dictLookup("Unix");
    if (fileName.isString()) {
      return fileName;
    }
  }
  return Object();
}