Re: [Tools-discuss] RFC PDF crashes viewer

[Erik Auerswald <[e-mail]>]

Hi,

On Fri, Jun 26, 2020 at 05:44:35PM +0200, Carsten Bormann wrote:
> This is undoubtedly a bug in the viewer, but I have received a report
> the PDF viewer evince (tested with versions 3.30.2 and 3.36.5, i.e.,
> newer than CVE-2019-1010006) crashes when trying to view:
>   
> https://www.rfc-editor.org/rfc/rfc8798.pdf
> 
> I have no further data at this time.

I can confirm this for evince in Ubuntu 18.04 LTS with current updates:

    $ evince --version
    GNOME Document Viewer 3.28.4
    $ evince rfc8798.pdf 
    Segmentation fault (core dumped)

CVE-2019-1010006 should be fixed there, too, see:
https://usn.ubuntu.com/4067-1/

The apport report shows a SIGSEGV during a function to free a string,
just as it did back in 2019 when the first RFC PDFs from xml2rfc v3 were
published:

    evince crashed with SIGSEGV in g_string_free()

Sadly my Ubuntu bug report from back then has disappeared, so I cannot
provide a reference.  Perhaps they did understand that this kind of
program behavior has security implications. ;-)

I have opened a new bug report for this file:

https://bugs.launchpad.net/ubuntu/+source/evince/+bug/1885313

Back then I noticed the problem with RFC 8655.  This problem still exists
(a further hint that my original bug report might have been hidden
because it may point to a still open security vulnerability):

    $ evince rfc8655.pdf 
    Segmentation fault (core dumped)

There were more PDF renderings of RFCs evince could not handle (or rather
cannot handle since) then, e.g. RFC 8650 and RFC 8651:

    $ evince rfc8650.pdf 
    Segmentation fault (core dumped)
    $ evince rfc8651.pdf 
    Segmentation fault (core dumped)

Those examples and more were included in my 2019 Ubuntu bug report.

Thanks,
Erik
-- 
Simplicity is prerequisite for reliability.
                        -- Edsger W. Dijkstra