oss-security - CVE-2015-0848 - Heap overflow on libwmf0.2-7

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEr-gPFc1eriF6FA4vHq2quDsLr6L2ZPEL6yPDjNazR84iNkCw@mail.gmail.com>
Date: Mon, 1 Jun 2015 03:06:57 -0500
From: Fernando Muñoz <fernando@...l-life.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-0848 - Heap overflow on libwmf0.2-7

libwmf is affected by a heap overflow on the function that decodes BMP images.

WMF files may contain both vector graphics and bitmap components. With
the attached WMF file, the issue can be reproduced, an overflow
happens because image_size gets a value of 32, that space is used to
allocate data->image

src/ipa/ipa/bmp.h, function ReadBMPImage:

1129    image_size = bytes_per_line * bmp->height;
1131    data->image = (unsigned char*) wmf_malloc (API,image_size);
1147        DecodeImage (API,bmp,src,(unsigned int)
bmp_info.compression,data->image);

Inside DecodeImage we have:

DecodeImage (wmfAPI* API,wmfBMP* bmp,BMPSource* src,unsigned int
compression,unsigned char* pixels)

874     for (u = 0; u < ((U32) bmp->width * (U32) bmp->height); u++)
pixels[u] = 0;

But bmp->width * bmp->height has a value of 64, and a write out of
bounds takes place.

$ wmf2svg --wmf-fontdir=/usr/share/fonts/type1/gsfonts bmpoverflow.wmf
<partial svg output>
*** Error in `wmf2svg': free(): invalid next size (fast): 0x091584b8 ***

ASAN enabled libwmf/wmf2svg shows the problem:

$ ./src/convert/wmf2svg --wmf-fontdir=/usr/share/fonts/type1/gsfonts
bmpoverflow.wmf
<partial svg output>
==3400==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xb5c268b0 at pc 0x807093e bp 0xbfc3cee8 sp 0xbfc3ced8
WRITE of size 1 at 0xb5c268b0 thread T0
    #0 0x807093d in DecodeImage ../../src/ipa/ipa/bmp.h:874
    #1 0x807093d in ReadBMPImage ../../src/ipa/ipa/bmp.h:1147
    #2 0x807093d in wmf_ipa_bmp_read ../../src/ipa/ipa/bmp.h:477
    #3 0x815f013 in meta_dib_brush player/meta.h:2187
    #4 0x815f013 in WmfPlayMetaFile
/home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:922
    #5 0x81a5ff5 in wmf_play /home/fmunozs/wmf/libwmf-0.2.8.4/src/player.c:323
    #6 0x804c583 in wmf2svg_draw
/home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2svg.c:208
    #7 0x804f2c5 in wmf2svg_file
/home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2svg.c:439
    #8 0x804ad78 in main
/home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2svg.c:458
    #9 0xb6efc72d in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x1872d)
    #10 0x804b46e
(/home/fmunozs/wmf/libwmf-0.2.8.4/src/convert/wmf2svg+0x804b46e)

0xb5c268b0 is located 0 bytes to the right of 32-byte region
[0xb5c26890,0xb5c268b0)
allocated by thread T0 here:
    #0 0xb72d718c in __interceptor_malloc
(/usr/lib/i386-linux-gnu/libasan.so.1+0x5118c)
    #1 0x80d74a8 in wmf_malloc /home/fmunozs/wmf/libwmf-0.2.8.4/src/api.c:482

This causes a Denial of Service, or could cause code execution since
the DecodeImage writes the data of the run-length decoded image to
data->image.

The attached file was fuzzed with lcamtuf's afl fuzzer.

Download attachment "bmpoverflow.wmf.gz" of type "application/x-gzip" (1575 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.