This issue does NOT affect the version of the elinks package, as shipped
with Red Hat Enterprise Linux 3.

This issue affects the versions of the elinks package, as shipped
with Red Hat Enterprise Linux 4 and 5.

Created attachment 360964 [details]
Local copy of upstream CVE-2008-7224 patch.

This bugs cause overflow (off-by-one) of entity_cache array, as last+1 entry was first initialized before array's upper bound was checked.  Out-of-array write can only be triggered by 8-character entities (shorter may also cause writes to unintended places, but all within entity_cache array).

Following structure is written past the array end:

    396 struct entity_cache {
    397 	unsigned int hits;
    398 	int strlen;
    399 	int encoding;
    400 	unsigned char *result;
    401 	unsigned char str[20]; /* Suffice in any case. */
    402 };

Out of the members, attacker may control encoding (possible values are very limited though), first 8 chars of str[] and possibly hits (though elinks may crash before hits gets incremented to a desired value).

As entity_cache is static array, real impact is not easily predictable, as it depends what other static data are placed right behind the array and how those are used.  This may not be as easy to reproduce reliably as stack / heap overflow.  I'm able to get crash on RHEL5/i386 version, but not on RHEL4 version.

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1471 https://rhn.redhat.com/errata/RHSA-2009-1471.html