[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <569CADC1.7000407@gmail.com>
Date: Mon, 18 Jan 2016 11:17:53 +0200
From: Paris Zoumpouloglou <pariszoump@...il.com>
To: oss-security@...ts.openwall.com
Subject: Buffer Overflow in lha compression utility
== Overview ==
LHA for UNIX (https://osdn.jp/projects/lha/) is an open source
implementation of the LHA compression utility and associated file format.
== Version ==
All tests were performed using the latest 20b6ba8 commit of the master
branch from https://osdn.jp/projects/lha/scm/git/lha/
== Details ==
Using the afl fuzzer, two cases which triggered a buffer overflow where
discovered. The problem existed in header.c:797-800 and header.c:913-916
while parsing level0 and level1 headers accordingly.
=797-800=
hdr->header_size = header_size = get_byte();
checksum = get_byte();
if (fread(data + COMMON_HEADER_SIZE,
header_size + 2 - COMMON_HEADER_SIZE, 1, fp) == 0) {
error("Invalid header (LHarc file ?)");
return FALSE; /* finish */
}
=913-916=
hdr->header_size = header_size = get_byte();
checksum = get_byte();
if (fread(data + COMMON_HEADER_SIZE,
header_size + 2 - COMMON_HEADER_SIZE, 1, fp) == 0) {
error("Invalid header (LHarc file ?)");
return FALSE; /* finish */
}
The header_size variable is determined from the first byte of the lha
archive header, which is read by the get_byte function. The returned
value is used in:
header_size + 2 - COMMON_HEADER_SIZE
to determine the elements' size used in fread() .
If the header_size is less than abs(2 - COMMON_HEADER_SIZE) = abs(2 -
21) = 19 then the size parameter is overflowed and a buffer overflow
occurs in fread.
== Timeline ==
2016-01-13 - Bug report submitted
2016-01-16 - Bug fix pushed to master (commit bf2471f)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
