bugGNU Octave - Bugs: bug #61053, [octave forge] (nan) Potential...

 
 

bug #61053: [octave forge] (nan) Potential Integer Overflow vulnerability in src/svm.cpp

Submitted by:  None
Submitted on:  Wed 18 Aug 2021 02:32:54 AM UTC  
 
Category:  Octave Forge Package Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Incorrect Result
Status:  None Assigned to:  None
Originator Name:  SubinKim Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  other
Operating System:  GNU/Linux

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 18 Aug 2021 08:28:50 AM UTC, comment #2: 

It seems that the line 2869 and lines 2984, 2988 are departed to separate functions. I am not using the version 3.6.0, but there seems to be no checking of model->l in version 3.6.0 as well.

Anonymous
Wed 18 Aug 2021 03:16:23 AM UTC, comment #1: 

Thank you for your finding.  Does this issue still exist in the latest package version 3.6.0 https://gnu-octave.github.io/packages/nan ?

Kai Torben Ohlhus <siko1056>
Project Member
Wed 18 Aug 2021 02:32:54 AM UTC, original submission:  

Hi, I found some integer overflow bug in the source code of octave-nan 3.4.5.
In src/svm.cpp,

77 #define Malloc(type,n) (type )malloc((n)sizeof(type))
2869 FSCANF(fp,"%d",&model->l);
2984 int l = model->l;
2988 model->sv_coef[i] = Malloc(double,l);

The program reads the value of l from an input file and calls malloc with l.
If a maliciously crafted input that sets l * 8 that will cause an integer overflow, the allocation with wrong value leads to buggy behavior like denial of service.
Thank you.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by siko1056 (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-18 siko1056 CategoryOctave Function => Octave Forge Package
        SummaryPotential Integer Overflow vulnerability in src/svm.cpp => [octave forge] (nan) Potential Integer Overflow vulnerability in src/svm.cpp

    Back to the top


    Powered by Savane 3.7