Closed ChijinZ closed 6 years ago
Thanks for the report. I'll take a look at it.
Please next time open one issue per incident, it's better if any discussion arises.
Minimized the 2nd issue into this:
__x_ _x___
I was mainly analyzing/debugging the 2nd issue but the fix seems to resolve both.
Multiple vulnerabilities in md4c
There are multiple vulnerabilities in md4c (git repository: https://github.com/mity/md4c, Latest commit 81e2a5c on Apr 12, 2018).
git log
Heap buffer overflow in md_split_simple_pairing_mark()
command: ./md2html testfile
testcase: https://github.com/ChijinZ/security_advisories/blob/master/md4c-81e2a5c/Heap_buffer_overflow_in_md_split_simple_pairing_mark
It seems like that an overflow happened in memcpy() in md4c.c:3499:
memcpy(dummy, mark, sizeof(MD_MARK));
AddressSanitizer provided information as below:
Heap buffer overflow in md_process_inlines()
command: ./md2html testfile
testcase: https://github.com/ChijinZ/security_advisories/blob/master/md4c-81e2a5c/Heap_buffer_overflow_in_md_process_inlines
It seems like that mark variable access a restricted area of memory in md4c.c:4004:
while(!(mark->flags & MD_MARK_RESOLVED) || mark->beg < off)
AddressSanitizer provided information as below: