REDHAT-BUG-526924: Integer Overflow
Ludwig Nussel reported an integer overflow in poppler's createsurfacefromthumbnaildata() function. cairopixels buffer is allocated as:
cairopixels = (guchar )gmalloc (4 width height);
http://cgit.freedesktop.org/poppler/poppler/tree/glib/poppler-page.cc#n615
where width / height is read from PDF file. Some validation of the values is done in Page::loadThumb(), but it is not sufficient to prevent the overflow:
if (width > INTMAX / 3 / height)
http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Page.cc#n547
This code does not exist in poppler as shipped in EL5, nor it is part of xpdf.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-526924?
The severity of REDHAT-BUG-526924 is high due to the potential for an integer overflow leading to memory corruption.
How do I fix REDHAT-BUG-526924?
To fix REDHAT-BUG-526924, update your Poppler package to a version that includes the patch for the integer overflow issue.
Which software is affected by REDHAT-BUG-526924?
The affected software for REDHAT-BUG-526924 is Poppler, specifically in its create_surface_from_thumbnail_data() function.
Can REDHAT-BUG-526924 lead to security vulnerabilities?
Yes, REDHAT-BUG-526924 can lead to security vulnerabilities by allowing potential exploitation through memory corruption.
Is there a workaround for REDHAT-BUG-526924 until I can apply a patch?
A potential workaround for REDHAT-BUG-526924 is to limit the input data size to prevent triggering the integer overflow.