Exploit-DB #39321
Description: pdfium - opj_jp2_apply_pclr 'libopenjpeg' Heap Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2016-01-26
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=626

The following crash was encountered in pdfium (the Chrome PDF renderer) during PDF fuzzing:

--- cut ---
==9326==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6250001bf680 at pc 0x[PII_REDACTED]75 bp 0x7ffca7393ea0 sp 0x7ffca7393e98
READ of size 4 at 0x6250001bf680 thread T0
    #0 0x892374 in opj_jp2_apply_pclr third_party/pdfium/third_party/libopenjpeg20/jp2.c:1018:18
    #1 0x88d536 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1512:5
    #2 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #3 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #4 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #5 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #6 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #7 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #8 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #9 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #10 0xb75693 in CPDF_PageRenderCache::StartGetCachedBitmap(CPDF_Stream*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:143:13
    #11 0xba9823 in CPDF_ProgressiveImageLoaderHandle::Start(CPDF_ImageLoader*, CPDF_ImageObject const*, CPDF_PageRenderCache*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1561:11
    #12 0xbaa67e in CPDF_ImageLoader::StartLoadImage(CPDF_ImageObject const*, CPDF_PageRenderCache*, void*&, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:1639:17
    #13 0xb7d368 in CPDF_ImageRenderer::StartLoadDIBSource() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:337:7
    #14 0xb77897 in CPDF_ImageRenderer::Start(CPDF_RenderStatus*, CPDF_PageObject const*, CFX_Matrix const*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp:484:7
    #15 0xb64fb6 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject const*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:320:10
    #16 0xb70a25 in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1152:13
    #17 0xb6f633 in CPDF_ProgressiveRenderer::Start(IFX_Pause*) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render.cpp:1090:3
    #18 0x52c1f1 in FPDF_RenderPage_Retail(CRenderContext*, void*, int, int, int, int, int, int, int, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/src/fpdfview.cpp:752:3
    #19 0x52b7fb in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/src/fpdfview.cpp:507:3
    #20 0x4dae22 in RenderPage(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, void* const&, void* const&, int, Options const&) third_party/pdfium/samples/pdfium_test.cc:363:3
    #21 0x4dd558 in RenderPdf(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, char const*, unsigned long, Options const&) third_party/pdfium/samples/pdfium_test.cc:520:9
    #22 0x4de3d1 in main third_party/pdfium/samples/pdfium_test.cc:597:5
0x6250001bf680 is located 0 bytes to the right of 9600-byte region [0x6250001bd100,0x6250001bf680)
allocated by thread T0 here:
    #0 0x4b0154 in __interceptor_calloc
    #1 0x88219f in opj_j2k_update_image_data third_party/pdfium/third_party/libopenjpeg20/j2k.c:8157:57
    #2 0x8817d7 in opj_j2k_decode_tiles third_party/pdfium/third_party/libopenjpeg20/j2k.c:9603:23
    #3 0x869d57 in opj_j2k_exec third_party/pdfium/third_party/libopenjpeg20/j2k.c:7286:41
    #4 0x869d57 in opj_j2k_decode third_party/pdfium/third_party/libopenjpeg20/j2k.c:9796
    #5 0x88d234 in opj_jp2_decode third_party/pdfium/third_party/libopenjpeg20/jp2.c:1483:8
    #6 0x8580f6 in opj_decode third_party/pdfium/third_party/libopenjpeg20/openjpeg.c:412:10
    #7 0x5d8c02 in CJPX_Decoder::Init(unsigned char const*, unsigned int) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:742:11
    #8 0x5dc7d0 in CCodec_JpxModule::CreateDecoder(unsigned char const*, unsigned int, bool) third_party/pdfium/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp:866:10
    #9 0xb9909c in decoder third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:75:36
    #10 0xb9909c in CPDF_DIBSource::LoadJpxBitmap() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:698
    #11 0xb917d3 in CPDF_DIBSource::CreateDecoder() third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:645:5
    #12 0xb8c8af in CPDF_DIBSource::StartLoadDIBSource(CPDF_Document*, CPDF_Stream const*, int, CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp:365:13
    #13 0xb75b33 in CPDF_ImageCache::StartGetCachedBitmap(CPDF_Dictionary*, CPDF_Dictionary*, int, unsigned int, int, CPDF_RenderStatus*, int, int) third_party/pdfium/core/src/fpdfapi/fpdf_render/fpdf_render_cache.cpp:308:7
    #14 0xb75