CVE-2023-2241 (C++, published 2023-04-22T16:15Z)
Description: value: A vulnerability, which was classified as critical, was found in PoDoFo 0.10.0. Affected is the function readXRefStreamEntry of the file PdfXRefStreamParserObject.cpp. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 535a786f124b739e3c857529cecc29e4eeb79778. It is recommended to apply a patch to fix this issue. VDB-227226 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/podofo/podofo
Files changed:
playground/CMakeLists.txt
src/podofo/main/PdfXRefStreamParserObject.cpp
test/unit/ParserTest.cpp
Commit message: PdfXRefStreamParserObject: Fixed handling of invalid XRef stream entries

Should fix #69


Vulnerable code:
project(PoDoFo)
        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef, "Invalid XRef stream /W array");
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef, "Invalid XRef stream /W array");
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef,
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef,
    char* cursor = buffer.data();
            if ((size_t)(cursor - buffer.data()) >= buffer.size())
                PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef, "Invalid count in XRef stream");

                readXRefStreamEntry(entry, cursor, wArray);
            cursor += entryLen;
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef, "Invalid XRef Stream /Index");
        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::NoXRef, "Invalid XRef Stream /Index");
TEST_CASE("testReadXRefStreamContents")
        REQUIRE(error.GetCode() == PdfErrorCode::NoXRef);
        REQUIRE(error.GetCode() == PdfErrorCode::NoXRef);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefType);
        REQUIRE(error.GetCode() == PdfErrorCode::NoXRef);
        REQUIRE(error.GetCode() == PdfErrorCode::NoXRef);
        REQUIRE(error.GetCode() == PdfErrorCode::NoXRef);

Fixed code:
project(podofo)
        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream, "Invalid XRef stream /W array");
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream, "Invalid XRef stream /W array");
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream,
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream,
    size_t offset = 0;
        if ((offset + count * entryLen) > buffer.size())
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream, "Invalid count in XRef stream");

                readXRefStreamEntry(entry, buffer.data() + offset, wArray);
            offset += entryLen;
            PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream, "Invalid XRef Stream /Index");
        PODOFO_RAISE_ERROR_INFO(PdfErrorCode::InvalidXRefStream, "Invalid XRef Stream /Index");
TEST_CASE("TestReadXRefStreamContents")
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);
        REQUIRE(error.GetCode() == PdfErrorCode::InvalidXRefStream);