bugunrtf - Bugs: bug #53563, attrstack_push does not check the...

 
 

bug #53563: attrstack_push does not check the return value of my_malloc

Submitter:  None
Submitted:  Wed 04 Apr 2018 08:24:36 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 04 Apr 2018 08:24:36 PM UTC, original submission:  

We got a segment fault when fuzzing unrtf-0.21.9.

The reproduction procedure is as follows:

```
wget https://www.gnu.org/software/unrtf/unrtf-0.21.9.tar.gz
tar -xvf unrtf-0.21.9.tar.gz
cd unrtf-0.21.9/
./bootstrap
./configure
make
ulimit -Sv 50000
./src/unrtf --latex ~/poc
ulimit -c unlimited
./src/unrtf --latex ~/poc
# Coredump generated
```

The stack trace is as follows:

```
#0  memset () at ../sysdeps/x86_64/memset.S:78
#1  0x0000000000401e0d in memset (__len=90016, __ch=0, __dest=0x0) at /usr/include/x86_64-linux-gnu/bits/string3.h:84
#2  attrstack_push () at attr.c:454
#3  0x00000000004077ad in word_print_core (w=w@entry=0x6693a0, groupdepth=groupdepth@entry=468) at convert.c:3326
#4  0x0000000000407a91 in word_print_core (w=w@entry=0x669360, groupdepth=groupdepth@entry=467) at convert.c:3554
#5  0x0000000000407a91 in word_print_core (w=w@entry=0x669320, groupdepth=groupdepth@entry=466) at convert.c:3554
#6  0x0000000000407a91 in word_print_core (w=w@entry=0x6692e0, groupdepth=groupdepth@entry=465) at convert.c:3554
#7  0x0000000000407a91 in word_print_core (w=w@entry=0x6692a0, groupdepth=groupdepth@entry=464) at convert.c:3554
#8  0x0000000000407a91 in word_print_core (w=w@entry=0x669260, groupdepth=groupdepth@entry=463) at convert.c:3554
#9  0x0000000000407a91 in word_print_core (w=w@entry=0x669220, groupdepth=groupdepth@entry=462) at convert.c:3554
#10 0x0000000000407a91 in word_print_core (w=w@entry=0x6691e0, groupdepth=groupdepth@entry=461) at convert.c:3554
#11 0x0000000000407a91 in word_print_core (w=w@entry=0x6691a0, groupdepth=groupdepth@entry=460) at convert.c:3554
#12 0x0000000000407a91 in word_print_core (w=w@entry=0x669160, groupdepth=groupdepth@entry=459) at convert.c:3554
#13 0x0000000000407a91 in word_print_core (w=w@entry=0x669120, groupdepth=groupdepth@entry=458) at convert.c:3554
...
```

Vulnerability Detail:

unrtf does check the return value from `my_malloc` in `attrstack_push:453` :

```
453 new_stack = (AttrStack*) my_malloc (sizeof (AttrStack));
454 memset ((void*) new_stack, 0, sizeof (AttrStack));
```

In the runtime with memory limit 50M, the `my_malloc` will fail and `new_stack` is NULL, then memset will encounter segment fault.

 Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #43801:  poc added by None (947B - application/octet-stream - PoC to trigger the segfault)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2018-04-04 None Attached File- Added poc, #43801

Back to the top

Copyright © 2025 Free Software Foundation, Inc.
Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
Page source code

Powered by Savane 3.14-8e77.
Corresponding source code