search

Yeraze / ytnef

Yeraze's TNEF Stream Reader - for winmail.dat files
GNU General Public License v2.0
32 stars 22 forks source link

out of bounds read with invalid input in TNEFVersion / SwapWord #33

Closed hannob closed 7 years ago

hannob commented 7 years ago

Passing the attached file to ytnefprint will cause an out of bounds heap memory read detectable with address sanitizer.

ytnef-oob-TNEFVersion-SwapWord.zip

Here's the asan error message:


==24836==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000012 at pc 0x0000004b9b25 bp 0x7ffe1183d850 sp 0x7ffe1183d000
READ of size 2 at 0x602000000012 thread T0
    #0 0x4b9b24 in __asan_memcpy (/mnt/ram/ytnef-1.9.1-2/ytnefprint/ytnefprint+0x4b9b24)
    #1 0x50ceeb in SwapWord /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:153:26
    #2 0x50ceeb in TNEFVersion /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:338
    #3 0x51721e in TNEFParse /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:1180:15
    #4 0x5161e4 in TNEFParseFile /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:1042:10
    #5 0x50965d in main /mnt/ram/ytnef-1.9.1-2/ytnefprint/main.c:80:9
    #6 0x7f3f8c9051e0 in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.24-r1/work/glibc-2.24/csu/../csu/libc-start.c:289
    #7 0x419979 in _start (/mnt/ram/ytnef-1.9.1-2/ytnefprint/ytnefprint+0x419979)

0x602000000012 is located 1 bytes to the right of 1-byte region [0x602000000010,0x602000000011)
allocated by thread T0 here:
    #0 0x4d05c0 in calloc (/mnt/ram/ytnef-1.9.1-2/ytnefprint/ytnefprint+0x4d05c0)
    #1 0x516c39 in TNEFParse /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:1150:12
    #2 0x5161e4 in TNEFParseFile /mnt/ram/ytnef-1.9.1-2/lib/ytnef.c:1042:10
    #3 0x50965d in main /mnt/ram/ytnef-1.9.1-2/ytnefprint/main.c:80:9
Yeraze commented 7 years ago

Integrated a fix into #32 .. Please review.

Yeraze commented 7 years ago

Closing as part of 1.9.2 release.