htmldoc: CVE-2021-20308: buffer-overflow caused by integer-overflow in image_load_gif()

Debian Bug report logs - #984765
htmldoc: CVE-2021-20308: buffer-overflow caused by integer-overflow in image_load_gif()

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Wooseok Kang <kangwoosuk1@gmail.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: htmldoc: buffer-overflow caused by integer-overflow in image_load_gif()

Date: Mon, 08 Mar 2021 16:06:04 +0900

[Message part 1 (text/plain, inline)]

Package: htmldoc
Version: 1.9.11-2
Severity: normal
X-Debbugs-Cc: kangwoosuk1@gmail.com

Dear Maintainer,

In htmldoc, there is an integer overflow vulnerability that is similar to CVE-2017-9181.
When the victim runs htmldoc with a maliciously crafted input,
arbitrary code may be executed in the victim's system.

The vulnerability resides in image_load_gif() function in htmldoc/image.cxx file.
In line 1279, the program reads data from given gif file using fread.

1279 fread(buf, 9, 1, fp);

Then, it stores value to 'img->width' and 'img->height' in line 1320,
and 'img->depth' is determined by whether given image is grayscale.

1320 img->width  = (buf[5] << 8) | buf[4];
1321 img->height = (buf[7] << 8) | buf[6];
1322 img->depth  = gray ? 1 : 3;

If load_data is equal to 1 and,
'img->width' and 'img->height' are enough large to cause an integer overflow,
the small heap block is allocated in line 1326.
It leads to buffer overrun when reads data to this buffer in gif_read_image().

1323 if (!load_data)
1324     return (0);
1325	 
1326 img->pixels = (uchar *)malloc((size_t)(img->width * img->height * img->depth));

I attach the maliciously crafted gif and html file which crashes htmldoc like below.
> htmldoc --webpage -f out.pdf htmldoc-poc.html
PAGES: 2
[1]    17884 segmentation fault  htmldoc --webpage -f out.pdf htmldoc-poc.html

Thank you.

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 5.4.72-microsoft-standard-WSL2 (SMP w/16 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages htmldoc depends on:
ii  htmldoc-common     1.9.11-2
ii  libc6              2.31-9
ii  libfltk-images1.3  1.3.5-3
ii  libfltk1.3         1.3.5-3
ii  libgnutls30        3.7.0-7
ii  libjpeg62-turbo    1:2.0.6-2
ii  libpng16-16        1.6.37-3
ii  libstdc++6         10.2.1-6
ii  libxpm4            1:3.5.12-1
ii  zlib1g             1:1.2.11.dfsg-2

htmldoc recommends no packages.

htmldoc suggests no packages.

-- no debconf information

[htmldoc-poc.gif (image/gif, attachment)]

[htmldoc-poc.html (text/plain, attachment)]

Send a report that this bug log contains spam.