[PDFBOX-4193] StackOverflow

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.0.13
• Fix Version/s: 2.0.14, 3.0.0 PDFBox
• Component/s: Parsing, PDModel
• Assignee: Tilman Hausherr
• Reporter: floyd
• Created: 17/Apr/18 11:40
• Updated: 28/Feb/19 17:45
• Resolved: 06/Feb/19 16:42

Description

As part of a fuzzing run with the AFL-based Kelinci fuzzer found at https://github.com/isstac/kelinci for a larger software that uses PDFBox I found the following StackOverflowError issues:

Exception in thread "main" java.lang.StackOverflowError
    at java.util.HashMap.hash(HashMap.java:338)
    at java.util.LinkedHashMap.get(LinkedHashMap.java:440)
    at org.apache.pdfbox.cos.COSDictionary.getDictionaryObject(COSDictionary.java:188)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2207)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)
    [...]
    at org.apache.pdfbox.pdfparser.COSParser.checkPagesDictionary(COSParser.java:2230)

Additionally, a second StackOverflowError was found:

Exception in thread "main" java.lang.StackOverflowError
    at java.util.HashMap.hash(HashMap.java:338)
    at java.util.LinkedHashMap.get(LinkedHashMap.java:440)
    at org.apache.pdfbox.cos.COSDictionary.getDictionaryObject(COSDictionary.java:188)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:102)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)

    [...]
    at org.apache.pdfbox.pdmodel.PDPageTree.getInheritableAttribute(PDPageTree.java:111)

The issues can be reproduced with the attached files.