You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@pdfbox.apache.org by Daniel Skiles <ds...@docfinity.com> on 2022/12/08 18:20:51 UTC
Infinite Loop when opening from an InputStream when file length is aligned to default chunk size
All,
I have what might be a bug in the 3.0.x series of PDFBox. It appears that
certain input can cause RandomAccessReadBuffer's constructor to enter an
infinite loop. I have attached a file that produces the behavior. When I
examined the contents, the first thing that stood out is that it has no EOF
indicator, but I've seen other broken files where that's the case, and they
terminate properly. I've found a few files like this, and it seems like
they're all exactly multiples of DEFAULT_CHUNK_SIZE_4KB in length.
If you use RandomAccessReadMemoryMappedFile, you don't see the same
behavior. Instead, it reads the file and throws a "Missing root object
specification in trailer" error in PDFParser. The sample code to reproduce
looks more or less like this:
try(final InputStream is = Files.newInputStream(Paths.get("<path to
attached>"))) {
final PDDocument d = Loader.loadPDF(is);
}
Is this a bug? If so, what is the process for reporting it?
Given the infinite loop aspect of this, could it represent a security issue
due to denial of service?
Re: Infinite Loop when opening from an InputStream when file length is aligned to default chunk size
Posted by Daniel Skiles <ds...@docfinity.com>.
That looks like it was the problem. I wasn't aware that alpha3 was newer
than RC1. Thank you.
On Thu, Dec 8, 2022 at 3:22 PM Tilman Hausherr <TH...@t-online.de>
wrote:
> Please check if this was fixed
> https://issues.apache.org/jira/browse/PDFBOX-5158
> Possible explanation: the latest 3.0 version is 3.0.0-alpha3, not RC1.
> Tilman
>
> On 08.12.2022 19:20, Daniel Skiles wrote:
> > All,
> > I have what might be a bug in the 3.0.x series of PDFBox. It appears
> > that certain input can cause RandomAccessReadBuffer's constructor to
> > enter an infinite loop. I have attached a file that produces the
> > behavior. When I examined the contents, the first thing that stood out
> > is that it has no EOF indicator, but I've seen other broken files
> > where that's the case, and they terminate properly. I've found a few
> > files like this, and it seems like they're all exactly multiples of
> > DEFAULT_CHUNK_SIZE_4KB in length.
> >
> > If you use RandomAccessReadMemoryMappedFile, you don't see the same
> > behavior. Instead, it reads the file and throws a "Missing root
> > object specification in trailer" error in PDFParser. The sample code
> > to reproduce looks more or less like this:
> >
> > try(final InputStream is = Files.newInputStream(Paths.get("<path to
> > attached>"))) {
> > final PDDocument d = Loader.loadPDF(is);
> > }
> >
> > Is this a bug? If so, what is the process for reporting it?
> >
> > Given the infinite loop aspect of this, could it represent a security
> > issue due to denial of service?
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
> > For additional commands, e-mail: users-help@pdfbox.apache.org
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
> For additional commands, e-mail: users-help@pdfbox.apache.org
>
>
Re: Infinite Loop when opening from an InputStream when file length is aligned to default chunk size
Posted by Tilman Hausherr <TH...@t-online.de>.
Please check if this was fixed
https://issues.apache.org/jira/browse/PDFBOX-5158
Possible explanation: the latest 3.0 version is 3.0.0-alpha3, not RC1.
Tilman
On 08.12.2022 19:20, Daniel Skiles wrote:
> All,
> I have what might be a bug in the 3.0.x series of PDFBox. It appears
> that certain input can cause RandomAccessReadBuffer's constructor to
> enter an infinite loop. I have attached a file that produces the
> behavior. When I examined the contents, the first thing that stood out
> is that it has no EOF indicator, but I've seen other broken files
> where that's the case, and they terminate properly. I've found a few
> files like this, and it seems like they're all exactly multiples of
> DEFAULT_CHUNK_SIZE_4KB in length.
>
> If you use RandomAccessReadMemoryMappedFile, you don't see the same
> behavior. Instead, it reads the file and throws a "Missing root
> object specification in trailer" error in PDFParser. The sample code
> to reproduce looks more or less like this:
>
> try(final InputStream is = Files.newInputStream(Paths.get("<path to
> attached>"))) {
> final PDDocument d = Loader.loadPDF(is);
> }
>
> Is this a bug? If so, what is the process for reporting it?
>
> Given the infinite loop aspect of this, could it represent a security
> issue due to denial of service?
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
> For additional commands, e-mail: users-help@pdfbox.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: users-help@pdfbox.apache.org