bugunrtf - Bugs: bug #55092, heap out of bounds read in...

 
 

bug #55092: heap out of bounds read in flush_iconv_input()

Submitter:  Hanno Boeck <hanno>
Submitted:  Sun 25 Nov 2018 08:43:12 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 25 Nov 2018 08:43:12 AM UTC, original submission:  

The attached sample will cause a heap out of bounds read, detectable with address sanitizer (-fsanitize=address in CFLAGS).

ASAN stack trace:

=================================================================
==2655==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000e68 at pc 0x00000043c6ca bp 0x7fffe7e1ba50 sp 0x7fffe7e1b1f0
READ of size 1001 at 0x619000000e68 thread T0
    #0 0x43c6c9 in __interceptor_fputs (/r/unrtf/unrtf+0x43c6c9)
    #1 0x505bdc in flush_iconv_input /f/unrtf/unrtf-0.21.9/src/convert.c:3278:9
    #2 0x505137 in word_print_core /f/unrtf/unrtf-0.21.9/src/convert.c:3591:9
    #3 0x502b68 in word_print /f/unrtf/unrtf-0.21.9/src/convert.c:3629:2
    #4 0x50f610 in main /f/unrtf/unrtf-0.21.9/src/main.c:266:3
    #5 0x7f14ecfe44ea in __libc_start_main (/lib64/libc.so.6+0x244ea)
    #6 0x41b469 in _start (/r/unrtf/unrtf+0x41b469)

0x619000000e68 is located 0 bytes to the right of 1000-byte region [0x619000000a80,0x619000000e68)
allocated by thread T0 here:
    #0 0x4c5953 in malloc (/r/unrtf/unrtf+0x4c5953)
    #1 0x51c0a5 in allocmem /f/unrtf/unrtf-0.21.9/src/util.c:150:10

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #45521:  flush_iconv_input.rtf added by hanno (30B - application/rtf)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by hanno (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-25 hanno Attached File- Added flush_iconv_input.rtf, #45521

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-269c.
    Corresponding source code