Invalid volume label string causes read beyond string size in fprintf at info_handle.c:1219

[hongxuchen]

AddressSanitizer: heap-buffer-overflow at info_handle.c:1219

POC file:
https://github.com/ntu-sec/pocs/blob/master/liblnk/hbo_info_handle.c%3A1219_1.input.txt

gdb output:
https://github.com/ntu-sec/pocs/blob/master/liblnk/hbo_info_handle.c%3A1219_1.gdb.txt

[joachimmetz]

The volume label data is:

liblnk_location_information_read_data: unicode volume information volume label size             : 4
liblnk_location_information_read_data: unicode volume information volume label data:
00000000: ce d9 00 00                                        ....

Converted into UTF-8, which does not appear to be correct.

liblnk_file_get_utf8_volume_label: volume information data:
00000000: ef bf bd                                           ...

which causes fprintf to read an additional byte.

==28427== Invalid read of size 1
==28427==    at 0x4C32BD4: __strlen_sse2 (vg_replace_strmem.c:460)
==28427==    by 0x52B4955: vfprintf (vfprintf.c:1643)
==28427==    by 0x52B5B8F: buffered_vfprintf (vfprintf.c:2330)
==28427==    by 0x52B2C55: vfprintf (vfprintf.c:1301)
==28427==    by 0x52BC183: fprintf (fprintf.c:32)
==28427==    by 0x40282B: info_handle_link_information_fprint (info_handle.c:1219)
==28427==    by 0x403F3D: info_handle_file_fprint (info_handle.c:2572)
==28427==    by 0x4046B5: main (lnkinfo.c:277)

[joachimmetz]

libyal/libuna#8

[joachimmetz]

With libuna libyal/libuna@fce50a5 this issue no longer surfaces. Seeing that no liblnk code needed to be changed to fix this issue, marking this as "invalid".