REDHAT-BUG-526877: Integer Overflow
xpdf's PSOutputDev::doImageL1Sep contains an integer overflow in the lineBuf buffer allocation:
4303 // allocate a line buffer 4304 lineBuf = (Guchar )gmalloc(4 width);
width is read from the input PDF file and can integer overflow / wrap when multiplied by 4, resulting in an insufficient memory allocation, leading to heap overflow.
Impact of this flaw is, however, quite limited. This affects PSOutputDev class used to write / convert PDF input to PS (PostScript) output. For GUI viewers, this is done e.g. when trying to print the file. Additionally, this requires non-default Level 1 separable PostScript language level to be used for the output file (specified via e.g. -level1sep command line option for pdftops, or psLevel configuration option in xpdfrc).
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-526877?
The severity of REDHAT-BUG-526877 is considered critical due to the potential for integer overflow in the buffer allocation.
How do I fix REDHAT-BUG-526877?
To fix REDHAT-BUG-526877, you should apply the patch provided in the vulnerability details to ensure proper handling of width values.
What causes the vulnerability in REDHAT-BUG-526877?
The vulnerability in REDHAT-BUG-526877 is caused by an integer overflow in the lineBuf buffer allocation when processing the 'width' value from the input PDF.
Which software is affected by REDHAT-BUG-526877?
The software affected by REDHAT-BUG-526877 is Xpdf.
Is there a workaround for REDHAT-BUG-526877?
Currently, there is no specific workaround for REDHAT-BUG-526877 other than updating to a patched version of the software.