-
Notifications
You must be signed in to change notification settings - Fork 355
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2019-1000032 - Memory corruption bug in nsvg__parseColorRGB #136
Comments
Here's an exploit with the latest library version:
Compile and run it with:
|
Please use |
78e7627 seems to fix this issue. But |
Have you heard of https://github.com/google/oss-fuzz ? That is a free Fuzzing-as-a-Service for open source software. I suspect you can find more bugs like this if you write a fuzzer or few. For example, the following fuzz target: #include <stddef.h>
#include <stdint.h>
#include <string>
#define NANOSVG_IMPLEMENTATION // Expands implementation
#include "nanosvg.h"
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
std::string str(reinterpret_cast<const char*>(Data), Size);
nsvg__parseColor(str.c_str());
return 0;
}
Finds a stack-buffer-overflow in seconds. If you're interested, please go through https://github.com/google/oss-fuzz/blob/master/docs/new_project_guide.md and let me know if you have any questions. |
How to fix this issue? Use the #include <stdio.h>
#include <stdlib.h>
#include <string.h>
static unsigned int nsvg__parseColorRGB(const char* str)
{
int r = -1, g = -1, b = -1;
char *s1 = NULL, *s2 = NULL;
int ret = 0;
sscanf(str + 4, "%d%m[%%, \t]%d%m[%%, \t]%d", &r, &s1, &g, &s2, &b);
if (s1 != NULL && strchr(s1, '%')) {
ret = 1;
}
if (s1) free(s1);
if (s2) free(s2);
return ret;
}
int main(int argc, char const *argv[])
{
printf("%d\n", nsvg__parseColorRGB("rgb(0%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%)"));
return 0;
} |
Offering up a suggestion that leverages more features of sscanf() and I think simplifies the parsing a bit.. feedback welcome.
|
Here's a v1 patch suggestion in the spirit of my last post that has minimal changes, should solve the security issue, and reduce code size. I don't think there's any locale issues here in the use of sscanf(), as it's just reading hex and integers. |
Thank you @erco77. This bug is the root cause of sile-typesetter/sile#1197. |
@erco77 I'm not quite sure what the status of this project is (there seem to be a lot of open PRs backed up without maintainer review) but if there is any chance of it being accepted could we talk you into submitting that patch as a PR? Since we're including a vendored version of the source in SILE (yes we need to un-vendor it, but that's a project for another time) we might even apply the patch there, but it would still be useful to have it in PR form here to track what we have done. |
Dear Alerque, Take care and best regards, |
I have super limited time to maintain this project. As @oehhar pointed out, a well prepared PR is the fastest way to get things fixed. |
Closes memononen#136, fixes [CVE-2019-1000032](https://0day.work/cve-2019-1000032-memory-corruption-in-nanosvg/).
@memononen I opened #198 which is just the patch above applied to |
@ctrlcctrlv Merged. Thanks for the PR! |
This simple Proof of Concept
crashes nanosvg.
In this snippet it is clear why this happens:
sscanf tries to parse the string, and writes arbitrary number of '%' or '\t' into the s1 or s2 buffer. The buffer overflows and triggers a segfault. This could lead to memory corruption and/or denial of service.
Regards
bitwave
CC: @gehaxelt for the fuzzing
The text was updated successfully, but these errors were encountered: