https://bugs.kde.org/show_bug.cgi?id=383915
Henrik Fehlauer <rk...@lab12.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |---
--- Comment #16 from Henrik Fehlauer <rk...@lab12.net> ---
Thanks for reaching out, this looks pretty bad. Can confirm the crash in Okular
is introduced with the commit above. It seems even if it was tested with older
versions of TeXLive this slipped through, sorry for that :\
As for the quality of the upstream code: Yeah, it has issues as hinted at in
the TODO in the commit message above. Project/code/branch management,
crossplatform building and (non-existing) buildsystem also leave much to be
desired.
In the medium term we should address two goals (besides getting rid of our
fork):
- Do not call into synctex code for non-synctex PDFs.
- Figure out how to handle this attack: Users gets sent exploit.zip, containing
exploit.pdf and exploit.synctex.gz. Game over after clicking on the PDF.
Ideas:
- Disable synctex entirely. → This would be the most responsible thing to
do, but distros might patch it in anyway…
- Warning message. → Does not help, just look at all the MS Office macro
viruses.
- Option in Okulars' preferences. → Helps "regular" users, but not those
actually needing synctex.
- Improve synctex code, e.g. with static analysis, running fuzzers, … →
Would need some helping hands.
- Deploy seccomp profiles for Okular. → Would need help too, but also
alleviates attacks against other formats.
Most likely nothing will happen due to lack of manpower though, I fear. Feel
free to pitch this to anyone interested.
Regarding fixing things right now, I have identified two issues (see next
comment for the details):
- In some situations, the synctex upstream code shows parse errors.
- The parse error triggers a code path where one of our hardening patches now
falls over.
I think I can fix the second problem (will be either in the RC tomorrow, but
latest for the final release).
Flupp: Could you report the first problem over at
https://github.com/jlaurens/synctex/issues?
--
You are receiving this mail because:
You are the assignee for the bug.
