Resources
People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!
Chrome: heap-buffer-overflow in chrome_pdf::PDFiumEngine::RequestThumbnail
Sergei Glazunov - Google Project Zero (P0)Posted 3 Years Ago- Chrome PDF Engine has a function called
RequestThumbNail. When an embedded PDF is added to a page, the thumbnail of the PDF can be accessed via apostMessage. Specifically, a call likeembed.postMessage({type: "getThumbnail", page: 2}); - When requesting a thumbnail there is no validation on the page number when attempting to get the thumbnail. There is a call to
DCHECK, but this is only is test builds and NOT production builds. - The object that is accessed out of bounds contains a function pointer that is immediately invoked. Hence, a properly placed object could easily lead to code execution.
- Another situation where an error check is done via code but not in the production version!
