CVE-2020-18750 (published 2021-02-05T19:15Z)

Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-120
cwe_name: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
extended_description: A buffer overflow condition exists when a product attempts to put more data in a buffer than it can hold, or when it attempts to put data in a memory area outside of the boundaries of a buffer. The simplest type of error, and the most common cause of buffer overflows, is the "classic" case in which the product copies the buffer without restricting how much is copied. Other variants exist, but the existence of a classic overflow strongly suggests that the programmer is not considering even the most basic of security protections.
         

Fix information:
repo_url: https://github.com/flexpaper/pdf2json
commit_details: repo_url: https://github.com/flexpaper/pdf2json
author: Erik
author_date: 2019-03-23 20:05:52+13:00
msg: Fix for heap vulnerability
repository: repo_url: https://github.com/flexpaper/pdf2json
repo_name: flexpaper/pdf2json
description: PDF2JSON is a conversion library based on XPDF (3.02) which can be used for high performance PDF page by page conversion to JSON and XML format. It also supports compressing data to minimize size. PDF2JSON is available for Windows, OSX and Linux. Please see https://flowpaper.com for more information
repo_language: C++
owner: flexpaper
file_changes: filename: CharCodeToUnicode.cc
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@
 #include "GlobalParams.h"
 #include "PSTokenizer.h"
 #include "CharCodeToUnicode.h"
+#include "GooLikely.h"
 
 //------------------------------------------------------------------------
 
@@ -320,9 +321,14 @@ void CharCodeToUnicode::addMapping(CharCode code, char *uStr, int n,
   if (code >= mapLen) {
     oldLen = mapLen;
     mapLen = (code + 256) & ~255;
-    map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode));
-    for (i = oldLen; i < mapLen; ++i) {
-      map[i] = 0;
+    if (unlikely(code >= mapLen)) {
+      error(-1, "Illegal code value in CharCodeToUnicode::addMapping");
+      return;
+    } else {
+      map = (Unicode *)greallocn(map, mapLen, sizeof(Unicode));
+      for (i = oldLen; i < mapLen; ++i) {
+        map[i] = 0;
+      }
     }
   }
   if (n <= 4) {

programming_language: C++
filename: GooLikely.h
change_type: ModificationType.ADD
diff: @@ -0,0 +1,22 @@
+//========================================================================
+//
+// GooLikely.h
+//
+// This file is licensed under the GPLv2 or later
+//
+// Copyright (C) 2008 Kees Cook <kees@outflux.net>
+//
+//========================================================================
+
+#ifndef GOOLIKELY_H
+#define GOOLIKELY_H
+
+#if defined(__GNUC__) && (__GNUC__ > 2) && defined(__OPTIMIZE__)
+# define likely(x)      __builtin_expect((x), 1)
+# define unlikely(x)    __builtin_expect((x), 0)
+#else
+# define likely(x)      (x)
+# define unlikely(x)    (x)
+#endif
+
+#endif

programming_language: C++