Six-Year-Old “Loop Bug” Re-Discovered to Affect Almost All Major PDF Viewers
A bug discovered in an obscure PDF parsing library back in 2011 is also
present in most of today's top PDF viewers, according to German software
developer Hanno Böck.
The original bug affected the PDF parser component included with Evince, a document viewer app for Linux. It was discovered by fellow German software developer Andreas Bogk, who helped Evince fixed the flaw, and presented his findings at the 2011 Chaos Communication Camp.
Bogk discovered that PDF documents with a certain structure — PDF files cross-referencing internal xref tables — would cause the Evince app to enter a continuous loop that would take up all of the local CPU’s resources, and quickly run out of memory, crashing the Evince app.
The pdf.js library, used in a similar capacity in Firefox, is also affected. Pdf.js is also used at GitHub to render PDF documents inside the website’s interface, without needing users to download the file and view it inside a third-party app. GitHub’s implementation is also vulnerable to endless loops that break PDF rendering on the site.
The Windows Runtime PDF Renderer library, or WinRT PDF, is also affected. This is Edge’s built-in PDF viewer, but also the default PDF parser for the Windows “Reader App,” the default PDF viewer app on Windows 8 and all later versions.
