Presentation
MuPDF is a lightweight, open source C/C++ PDF and XPS viewing and rendering library maintained by Artifex Software. While auditing the source code of the product, our researcher Jean-Jamil Khalife discovered, within about two hours, both a denial of service and a stack-based buffer overflow. The overflow can be escalated to full remote code execution when a victim opens a malicious XPS document.
The flaw lives in the XPS parsing path. When MuPDF loads an XPS document it renders the first page and parses each element through xps_parse_element(), following the ECMA-388 (OpenXPS) specification. A crafted Path element whose Fill attribute carries a ContextColor value with too many color components overflows a fixed-size stack buffer, giving an attacker control over execution flow.
Issue(s)
- Stack-based buffer overflow in
xps_parse_color()(xps/xps-common.c): the function copies every floating point component of aContextColorvalue into a fixedfloat samples[32]stack buffer declared in the callerxps_parse_path(), without ever checking the destination array bound. - The only loop guard is the number of commas parsed in the input string, never the capacity of
samples, so an attacker fully controls how far past the buffer the write goes. - The condition is reachable purely from attacker-controlled document content (the
Fillattribute of aPath), which turns a single crafted XPS file into a reliable memory-corruption primitive and, on the tested builds, remote code execution.
Full technical analysis
The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20130126-mupdf/
References
- HDW Sec blog: https://www.hdwsec.fr/blog/20130126-mupdf/
- CVE-2014-2013 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2014-2013