CVE-2019-9199 (published 2019-02-26T23:29Z)

PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mksdev/podofo
commit_details: repo_url: https://github.com/mksdev/podofo
author: mabri
author_date: 2019-03-09 18:29:29+00:00
msg: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.


git-svn-id: http://svn.code.sf.net/p/podofo/code/podofo/trunk@1971 e6e4d1b7-ffb3-4f57-9d89-6d52b3892af5
repository: repo_url: https://github.com/mksdev/podofo
repo_name: mksdev/podofo
description: PoDoFo is a library to work with the PDF file format. The name comes from the first letter of PDF (Portable Document Format). A few tools to work with PDF files are already included in the PoDoFo package. This repo is a mirror of the code at http://svn.code.sf.net/p/podofo/code/podofo/trunk. Mirror scripts https://github.com/mksdev/podofo-download
repo_language: C++
owner: mksdev
file_changes: filename: pdftranslator.cpp
change_type: ModificationType.MODIFY
diff: @@ -148,7 +148,12 @@ namespace PoDoFo
 // 	std::cerr << "Document has "<< pcount << " page(s) " << endl;
 			if ( pcount > 0 ) // only here to avoid possible segfault, but PDF without page is not conform IIRC
 			{
-				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
+                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
+                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
+                {
+                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
+                }
+                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
 				// keep in mind it’s just a hint since PDF can have different page sizes in a same doc
 				sourceWidth =  rect.GetWidth() - rect.GetLeft();
 				sourceHeight =  rect.GetHeight() - rect.GetBottom() ;

programming_language: C++
repo_url: https://github.com/jjanku/podofo
commit_details: repo_url: https://github.com/jjanku/podofo
author: Beatriz Manrique
author_date: 2019-03-09 18:29:29+00:00
msg: Fixed CVE-2019-9199, issue #40 (raises PdfError with PageNotFound code on error)

The error is the page 0 (0-based) not being found, before this fix that led to
a null pointer dereference (method call on a null pointer, undefined behavior),
now just a PdfError exception is raised.
repository: repo_url: https://github.com/jjanku/podofo
repo_name: jjanku/podofo
description: git svn clone of http://podofo.sourceforge.net/
repo_language: C++
owner: jjanku
file_changes: filename: pdftranslator.cpp
change_type: ModificationType.MODIFY
diff: @@ -148,7 +148,12 @@ namespace PoDoFo
 // 	std::cerr << "Document has "<< pcount << " page(s) " << endl;
 			if ( pcount > 0 ) // only here to avoid possible segfault, but PDF without page is not conform IIRC
 			{
-				PoDoFo::PdfRect rect ( sourceDoc->GetPage ( 0 )->GetMediaBox() );
+                PoDoFo::PdfPage* pFirstPage = sourceDoc->GetPage ( 0 );
+                if ( NULL == pFirstPage ) // Fixes CVE-2019-9199 (issue #40)
+                {
+                    PODOFO_RAISE_ERROR_INFO( ePdfError_PageNotFound, "First page (0) of source document not found" );
+                }
+                PoDoFo::PdfRect rect ( pFirstPage->GetMediaBox() );
 				// keep in mind it’s just a hint since PDF can have different page sizes in a same doc
 				sourceWidth =  rect.GetWidth() - rect.GetLeft();
 				sourceHeight =  rect.GetHeight() - rect.GetBottom() ;

programming_language: C++