Caradoc: a pragmatic approach to PDF parsing and validation

Guillaume Endignoux (1) , Olivier Levillain (2) , Jean-Yves Migeon (2)

1 EPFL - Ecole Polytechnique Fédérale de Lausanne
2 ANSSI - Agence nationale de la sécurité des systèmes d'information

PDF has become a de facto standard for exchanging electronic documents, for visualization as well as for printing. However, it has also become a common delivery channel for malware, and previous work has highlighted features that lead to security issues. In our work, we focus on the structure of the format, independently from specific features. By methodically testing PDF readers against hand-crafted files, we show that the interpretation of PDF files at the structural level may cause some form of denial of service, or be ambiguous and lead to rendering inconsistencies among readers. We then propose a pragmatic solution by restricting the syntax to avoid common errors, and propose a formal grammar for it. We explain how data consistency can be validated at a finer-grained level using a dedicated type checker. Finally, we assess this approach on a set of real-world files and show that our proposals are realistic.

Domaines: Cryptographie et sécurité [cs.CR]

Guillaume Endignoux, Olivier Levillain, Jean-Yves Migeon. Caradoc: a pragmatic approach to PDF parsing and validation. 2016 IEEE Security and Privacy Workshops (SPW), May 2016, San Jose, France. pp.126-139. ⟨hal-02143706⟩