bugGNU Octave - Bugs: bug #61053, [octave forge] (nan) Potential...

 
 

bug #61053: [octave forge] (nan) Potential Integer Overflow vulnerability in src/svm.cpp

Submitter:  None
Submitted:  Wed 18 Aug 2021 02:32:54 AM UTC
   
 
Category:  Octave Package Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Incorrect Result
Status:  None Assigned to:  None
Originator Name:  SubinKim Originator Email:  -email is unavailable-
Open/Closed:  * Open Release:  * other
Operating System:  * GNU/Linux Fixed Release:  None
Planned Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 18 Aug 2021 08:28:50 AM UTC, comment #2: 

It seems that the line 2869 and lines 2984, 2988 are departed to separate functions. I am not using the version 3.6.0, but there seems to be no checking of model->l in version 3.6.0 as well.

Anonymous
Wed 18 Aug 2021 03:16:23 AM UTC, comment #1: 

Thank you for your finding.  Does this issue still exist in the latest package version 3.6.0 https://gnu-octave.github.io/packages/nan ?

Kai Torben Ohlhus <siko1056>
Group Member
Wed 18 Aug 2021 02:32:54 AM UTC, original submission:  

Hi, I found some integer overflow bug in the source code of octave-nan 3.4.5.
In src/svm.cpp,

77 #define Malloc(type,n) (type *)malloc((n)*sizeof(type))
2869 FSCANF(fp,"%d",&model->l);
2984 int l = model->l;
2988 model->sv_coef[i] = Malloc(double,l);


The program reads the value of l from an input file and calls malloc with l.
If a maliciously crafted input that sets l * 8 that will cause an integer overflow, the allocation with wrong value leads to buggy behavior like denial of service.
Thank you.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by siko1056 (Updated the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only group members can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-18 siko1056 CategoryOctave Function Octave Package
        SummaryPotential Integer Overflow vulnerability in src/svm.cpp [octave forge] (nan) Potential Integer Overflow vulnerability in src/svm.cpp

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code