Bug 1547883 - heap-buffer-overflow in freexl.c:1805 parse_SST parse_SST
Summary: heap-buffer-overflow in freexl.c:1805 parse_SST parse_SST
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: freexl
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Volker Fröhlich
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-02-22 08:21 UTC by Leon
Modified: 2018-04-15 02:35 UTC (History)
2 users (show)

Fixed In Version: freexl-1.0.5-1.fc26 freexl-1.0.5-1.el6 freexl-1.0.5-1.fc28
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-15 02:35:11 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
POC file that crashing FreeXL in freexl.c:1805 parse_SST (23.63 KB, application/x-ole-storage)
2018-02-22 08:21 UTC, Leon
no flags Details

Description Leon 2018-02-22 08:21:54 UTC
Created attachment 1399221 [details]
POC file that crashing FreeXL in freexl.c:1805 parse_SST

Description of problem:
The parse_SST function in FreeXL 1.0.4 may result a heap-buffer-overflow via a crafted xls file.

Version-Release number of selected component (if applicable):
1.0.4

How reproducible:
/examples/test_xl $POC

Steps to Reproduce:
/examples/test_xl $POC

Actual results:
Segmentation fault

Expected results:


Additional info:
The output of test_xl with address sanitizer enabled

./test_xl /root/fuzz/freexl/freexl-freexl-1805-overflow 
=================================================================
==49500==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000108e8 at pc 0x00000040cf41 bp 0x7ffeaf6cd030 sp 0x7ffeaf6cd020
READ of size 1 at 0x6310000108e8 thread T0
    #0 0x40cf40 in parse_SST /root/asan/freexl-1.0.4/src/freexl.c:1805
    #1 0x414660 in parse_biff_record /root/asan/freexl-1.0.4/src/freexl.c:3017
    #2 0x419afe in read_biff_next_record /root/asan/freexl-1.0.4/src/freexl.c:3867
    #3 0x41b59c in common_open /root/asan/freexl-1.0.4/src/freexl.c:4131
    #4 0x41be70 in freexl_open /root/asan/freexl-1.0.4/src/freexl.c:4231
    #5 0x401709 in main /root/asan/freexl-1.0.4/examples/test_xl.c:84
    #6 0x7f66e6b3982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x4013a8 in _start (/root/asan/freexl-1.0.4/examples/test_xl+0x4013a8)

0x6310000108e8 is located 0 bytes to the right of 65768-byte region [0x631000000800,0x6310000108e8)
allocated by thread T0 here:
    #0 0x7f66e7284602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x408e51 in alloc_workbook /root/asan/freexl-1.0.4/src/freexl.c:1208
    #2 0x41b1fe in common_open /root/asan/freexl-1.0.4/src/freexl.c:4066
    #3 0x41be70 in freexl_open /root/asan/freexl-1.0.4/src/freexl.c:4231
    #4 0x401709 in main /root/asan/freexl-1.0.4/examples/test_xl.c:84
    #5 0x7f66e6b3982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/asan/freexl-1.0.4/src/freexl.c:1805 parse_SST
Shadow bytes around the buggy address:
  0x0c627fffa0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffa100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c627fffa110: 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]fa fa
  0x0c627fffa120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffa160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==49500==ABORTING

Weiran Labs, Zhaoliang
leon.zhao.7

Comment 1 Fedora Update System 2018-02-22 23:37:54 UTC
freexl-1.0.5-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-2eb691e7d7

Comment 2 Fedora Update System 2018-02-22 23:38:14 UTC
freexl-1.0.5-1.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-9111777f91

Comment 3 Fedora Update System 2018-02-23 08:54:36 UTC
freexl-1.0.5-1.el6 has been submitted as an update to Fedora EPEL 6. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2ffe688829

Comment 4 Fedora Update System 2018-02-23 08:54:53 UTC
freexl-1.0.5-1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2018-5573046c3b

Comment 5 Fedora Update System 2018-02-23 16:27:34 UTC
freexl-1.0.5-1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-5573046c3b

Comment 6 Fedora Update System 2018-02-23 16:29:55 UTC
freexl-1.0.5-1.el6 has been pushed to the Fedora EPEL 6 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-2ffe688829

Comment 7 Fedora Update System 2018-02-23 16:30:59 UTC
freexl-1.0.5-1.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2018-9111777f91

Comment 8 Fedora Update System 2018-02-23 16:57:56 UTC
freexl-1.0.5-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-2eb691e7d7

Comment 9 Salvatore Bonaccorso 2018-02-23 21:09:20 UTC
Hi

MITRE has assigned CVE-2018-7436 for this issue.

Regards,
Salvatore

Comment 10 Fedora Update System 2018-03-06 17:23:38 UTC
freexl-1.0.5-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2018-03-06 17:29:48 UTC
freexl-1.0.5-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2018-03-11 19:44:26 UTC
freexl-1.0.5-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2018-03-13 17:07:51 UTC
freexl-1.0.5-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2018-04-08 20:36:43 UTC
freexl-1.0.5-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-62268d69c9

Comment 15 Fedora Update System 2018-04-09 21:53:56 UTC
freexl-1.0.5-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-62268d69c9

Comment 16 Fedora Update System 2018-04-15 02:35:11 UTC
freexl-1.0.5-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.