#329 Out of bounds read in function `DJVU::DataPool::has_data` when input craft djvu file

[chen ivan]

To Reproduce

./ddjvu ./poc.djvu

Debug Info

# ./ddjvu ./poc.djvu
==21493==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000001b8 (pc 0x0000005bb4df bp 0x7fffffffd0d0 sp 0x7fffffffd0a0 T0)
==21493==The signal is caused by a READ memory access.
==21493==Hint: address points to the zero page.
    #0 0x5bb4df in DJVU::DataPool::has_data(int, int) /src/djvulibre-ddjvu/libdjvu/DataPool.cpp:1089:21
    #1 0x5b85de in DJVU::DataPool::connect(DJVU::GP<DJVU::DataPool> const&, int, int) /src/djvulibre-ddjvu/libdjvu/DataPool.cpp:883:14
    #2 0x5b82f6 in DJVU::DataPool::create(DJVU::GP<DJVU::DataPool> const&, int, int) /src/djvulibre-ddjvu/libdjvu/DataPool.cpp:797:10
    #3 0x6135ee in DJVU::DjVuFile::init(DJVU::GURL const&, DJVU::GP<DJVU::DjVuPort>) /src/djvulibre-ddjvu/libdjvu/DjVuFile.cpp:249:19
    #4 0x61313a in DJVU::DjVuFile::create(DJVU::GURL const&, DJVU::GP<DJVU::DjVuPort>, DJVU::DjVuPort::ErrorRecoveryAction, bool) /src/djvulibre-ddjvu/libdjvu/DjVuFile.cpp:216:9
    #5 0x5f828f in DJVU::DjVuDocument::url_to_file(DJVU::GURL const&, bool) const /src/djvulibre-ddjvu/libdjvu/DjVuDocument.cpp:891:12
    #6 0x5f89c4 in DJVU::DjVuDocument::get_djvu_file(int, bool) const /src/djvulibre-ddjvu/libdjvu/DjVuDocument.cpp:963:22
    #7 0x5fa911 in DJVU::DjVuDocument::get_page(int, bool, DJVU::DjVuPort*) const /src/djvulibre-ddjvu/libdjvu/DjVuDocument.cpp:1063:28
    #8 0x569f7a in DJVU::DjVuDocument::get_page(int, bool, DJVU::DjVuPort*) /src/djvulibre-ddjvu/libdjvu/./DjVuDocument.h:604:53
    #9 0x5363cd in ddjvu_page_create(DJVU::ddjvu_document_s*, DJVU::ddjvu_job_s*, char const*, int) /src/djvulibre-ddjvu/libdjvu/ddjvuapi.cpp:1580:23
    #10 0x4d33f6 in dopage(int) /src/djvulibre-ddjvu/tools/ddjvu.cpp:733:17
    #11 0x4d4717 in parse_pagespec(char const*, int, void (*)(int)) /src/djvulibre-ddjvu/tools/ddjvu.cpp:825:11
    #12 0x4df19b in main /src/djvulibre-ddjvu/tools/ddjvu.cpp:1214:3
    #13 0x7ffff651a83f in __libc_start_main /build/glibc-e6zv40/glibc-2.23/csu/../csu/libc-start.c:291
    #14 0x41eff8 in _start (/mnt/disk/out/djvulibre-ddjvu/ddjvu_asan+0x41eff8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /src/djvulibre-ddjvu/libdjvu/DataPool.cpp:1089:21 in DJVU::DataPool::has_data(int, int)
==21493==ABORTING

I think unchecked variables pool is the root cause of this vulnerability

GP<DataPool>
DataPool::create(const GP<DataPool> & pool, int start, int length)
{
  DEBUG_MSG("DataPool::DataPool: pool=" << (void *)((DataPool *)pool) << " start=" << start << " length= " << length << "\n");
  DEBUG_MAKE_INDENT(3);

  DataPool *xpool=new DataPool();
  GP<DataPool> retval=xpool;
  xpool->init();
  xpool->connect(pool, start, length);
                 ^^^^
  return retval;
}

Environment:

• version : djvulibre master (ee314b880c926e884be77d53ee459d9850c9c7f0)
• OS: Ubuntu 16.04
• clang version: 11

Credit: 1vanChen of NSFOCUS Security Team