anicholson / anicholson/origami-pdf
pdf2ruby: Cant parse and generate ruby for invalid/malicious pdfs
- 主要語言
- Ruby
- 星號
- 0
- 分支
- 0
- PR 合併指標
- 30 天內沒有已合併 PR
描述
```
What steps will reproduce the problem?
1. Run pdf2ruby on malicious pdf that uses /Colors where is > then
4
What is the expected output? What do you see instead?
Since this library and associated binaries are tailored to working with
malicious pdfs it would be nice if pdf2ruby would be able to process such files
instead I get:
$ pdf2ruby adobe_flatedecode_predictor02-exploit.pdf[*] Loading document
'adobe_flatedecode_predictor02-exploit.pdf'
[*] Document successfully loaded into Origami
[*] Retrieving all indirect objects...
[*] Retrieving the document Catalog...
[*] Processing the object hierarchy...
origami-1.2.3/lib/origami/stream.rb:367:in `rescue in decode_data': Error while
decoding stream 7 0 R (Origami::InvalidStreamObjectError)
-> [Origami::Filter::PredictorError] Colors must be between 1 and 4
What version of the product are you using? On what operating system?
origami-1.2.3, ubuntu linux, ruby-1.9.2-p0 via rvm
Please provide any additional information below.
Consider the following attachment as an example which is a exploit generated by
the metasploit adobe_flatedecode_predictor02 (with flate and encoding
disabled). Object 7 triggers the CVE 2009-3459 with an integer overflow
(/Colors 1073741838 which is invalid as per the pdf specification).
Also I am really impressed with this gem! Thanks for all the work!
```
Original issue reported on code.google.com by `Dennison...@gmail.com` on 20 Dec 2011 at 10:22
Attachments:
- [adobe_flatedecode_predictor02-exploit.pdf](https://storage.googleapis.com/google-code-attachments/origami-pdf/issue-8/comment-0/adobe_flatedecode_predictor02-exploit.pdf)
貢獻指南
這個儲存庫沒有索引到貢獻指南
評估
這個 Issue 還沒有評估資料。