Closed
Description
Hello, While fuzzing htmldoc , I found a stack-buffer-overflow in parse_table() ps-pdf.cxx:6611:25
- test platform
htmldoc Version 1.9.12 git [master 6898d0a]
OS :Ubuntu 20.04.1 LTS x86_64
kernel: 5.4.0-53-generic
compiler: clang version 10.0.0-4ubuntu1
reproduced:
htmldoc -f demo.pdf poc6.html
poc(zipped for update):
poc6.zip
=================================================================
==38215==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff47945520 at pc 0x000000589ba7 bp 0x7fff47941170 sp 0x7fff47941168
READ of size 4 at 0x7fff47945520 thread T0
#0 0x589ba6 in parse_table(tree_str*, float, float, float, float, float*, float*, int*, int) /home//htmldoc_sani/htmldoc/ps-pdf.cxx:6611:25
#1 0x558013 in parse_doc(tree_str*, float*, float*, float*, float*, float*, float*, int*, tree_str*, int*) /home//htmldoc_sani/htmldoc/ps-pdf.cxx:4167:11
#2 0x556c54 in parse_doc(tree_str*, float*, float*, float*, float*, float*, float*, int*, tree_str*, int*) /home//htmldoc_sani/htmldoc/ps-pdf.cxx:4081:9
#3 0x556c54 in parse_doc(tree_str*, float*, float*, float*, float*, float*, float*, int*, tree_str*, int*) /home//htmldoc_sani/htmldoc/ps-pdf.cxx:4081:9
#4 0x54f90e in pspdf_export /home//htmldoc_sani/htmldoc/ps-pdf.cxx:803:3
#5 0x53c845 in main /home//htmldoc_sani/htmldoc/htmldoc.cxx:1291:3
#6 0x7ffbda5cf0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#7 0x41f8bd in _start (/home//htmldoc_sani/htmldoc/htmldoc+0x41f8bd)
Address 0x7fff47945520 is located in stack of thread T0 at offset 17312 in frame
#0 0x585052 in parse_table(tree_str*, float, float, float, float, float*, float*, int*, int) /home//htmldoc_sani/htmldoc/ps-pdf.cxx:6308
This frame has 12 object(s):
[32, 36) 'left.addr'
[48, 52) 'right.addr'
[64, 17312) 'table' (line 6317) <== Memory access at offset 17312 overflows this variable
[17568, 17572) 'col_min' (line 6318)
[17584, 17588) 'col_pref' (line 6318)
[17600, 17604) 'col_height' (line 6318)
[17616, 17620) 'temp_bottom' (line 6318)
[17632, 17636) 'temp_top' (line 6318)
[17648, 17652) 'temp_page' (line 6335)
[17664, 17676) 'bgrgb' (line 6346)
[17696, 17951) 'table_text' (line 6980)
[18016, 18020) 'temp_y' (line 7092)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home//htmldoc_sani/htmldoc/ps-pdf.cxx:6611:25 in parse_table(tree_str*, float, float, float, float, float*, float*, int*, int)
Shadow bytes around the buggy address:
0x100068f20a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100068f20a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100068f20a70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100068f20a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x100068f20a90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100068f20aa0: 00 00 00 00[f2]f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
0x100068f20ab0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2
0x100068f20ac0: f2 f2 f2 f2 04 f2 04 f2 04 f2 04 f2 04 f2 04 f2
0x100068f20ad0: 00 04 f2 f2 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
0x100068f20ae0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
0x100068f20af0: f8 f8 f8 f8 f2 f2 f2 f2 f2 f2 f2 f2 f8 f3 f3 f3
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==38215==ABORTING
─ source:ps-pdf.cxx+6611 ────
6606 table.col_smins[col] = col_min;
6607
6608 temp_width = col_width / colspan;
6609 for (int i = 0; i < colspan; i ++)
6610 {
// i=0x1d0a, col=0x1
→ 6611 if (temp_width > table.col_widths[col + i])
6612 table.col_widths[col + i] = temp_width;
6613 }
6614 }
6615 else
6616 {
─ threads ────
[#0] Id 1, Name: "htmldoc", stopped 0x4238fa in parse_table (), reason: SIGSEGV
─ trace ────
[#0] 0x4238fa → parse_table(t=0x918b60, left=0, right=487, bottom=22, top=698, x=<optimized out>, y=0x7fffffffb674, page=<optimized out>, needspace=0x1)
[#1] 0x4157c0 → parse_doc(t=0x918b60, left=0x7fffffffb6e8, right=0x7fffffffb6e4, bottom=0x7fffffffb6ac, top=<optimized out>, x=<optimized out>, y=0x7fffffffb674, page=0x7fffffffb684, cpara=0x917d10, needspace=0x7fffffffb6d4)
[#2] 0x414964 → parse_doc(t=0x918390, left=<optimized out>, right=<optimized out>, bottom=<optimized out>, top=0x7fffffffb69c, x=0x7fffffffb6ec, y=<optimized out>, page=<optimized out>, cpara=<optimized out>, needspace=<optimized out>)
[#3] 0x414964 → parse_doc(t=0x9171d0, left=<optimized out>, right=<optimized out>, bottom=<optimized out>, top=0x7fffffffb69c, x=0x7fffffffb6ec, y=<optimized out>, page=<optimized out>, cpara=<optimized out>, needspace=<optimized out>)
[#4] 0x411980 → pspdf_export(document=<optimized out>, toc=<optimized out>)
[#5] 0x408e89 → main(argc=<optimized out>, argv=<optimized out>)
reporter： chiba of topsec alphalab