Bug 1786740 (CVE-2019-19847)

Summary:	CVE-2019-19847 libspiro: stack-based off-by-one buffer overflow in spiro_to_bpath0() in spiro.c
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	eng-i18n-bugs, kevin, nphilipp, pnemade
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An off-by-one vulnerability was found in libspiro in the way a double array is first declared in a unit test and then accessed by the library itself. Applications that make use of libspiro in the same way as the example code in the test suite may be vulnerable to this flaw. A remote attacker could abuse this flaw to make the application crash or potentially execute arbitrary code.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-03 20:09:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1786742
Bug Blocks:	1786741

Description Guilherme de Almeida Suckevicz 2019-12-27 16:20:51 UTC

Libspiro through 20190731 has a stack-based buffer overflow in the spiro_to_bpath0() function in spiro.c.

Reference:
https://github.com/fontforge/libspiro/issues/21

Comment 1 Guilherme de Almeida Suckevicz 2019-12-27 16:21:47 UTC

Created libspiro tracking bugs for this issue:

Affects: fedora-all [bug 1786742]

Comment 2 Mauro Matteo Cascella 2020-01-03 11:32:34 UTC

Upstream fix:
https://github.com/fontforge/libspiro/commit/35233450c922787dad42321e359e5229ff470a1e

Comment 3 Mauro Matteo Cascella 2020-01-03 14:34:55 UTC

The function test_curve() in tests/call-test.c declares a double array of size 5 and later calls spiro_to_bpath0() in spiro.c by passing the array as third argument. spiro_to_bpath0() accesses the last element of the array with index 5. This causes an off-by-one error which leads to a stack-based buffer overflow.

It is worth noting that even though the buffer overflow takes place in spiro.c, the affected array is declared in the test suite (only used for testing purposes) and *not* in the library itself.

Comment 5 Product Security DevOps Team 2020-01-03 20:09:24 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19847

Comment 7 Eric Christensen 2020-01-09 02:52:18 UTC

Statement:

This issue did not affect the versions of libspiro as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code. The vulnerable function was introduced in a newer version of the package.