Package: antiword
Version: 0.37-18
Severity: normal
Dear Maintainer,
I found an out-of-bounds read while fuzzing Antiword 0.37 with AFL++.
The issue is reproducible against the Debian 0.37-18 source package when
built with AddressSanitizer.
A malformed .doc file causes vGet8PapInfo() in prop8.c to use
document-controlled FKP/PAP metadata without adequately validating the
calculated offsets against the 512-byte FKP page.
For one reproducer, AddressSanitizer reports:
ERROR: AddressSanitizer: stack-buffer-overflow
...
#0 vGet8PapInfo .../prop8.c:1001
GDB shows the following values immediately before the invalid access:
iRun = 53
iIndex2 = 23
(iRun + 1) * 4 + iIndex2 * 13 = 515
sizeof(aucFpage) = 512
The resulting index is therefore 515 bytes into a 512-byte stack buffer.
Other AFL inputs produced related out-of-bounds reads at prop8.c:1013
in vGet8PapInfo() and prop8.c:549 in vGet8StyleInfo(). These appear to
be manifestations of the same missing bounds validation in the FKP/PAP
record parsing path.
Reproduction:
1. Build Debian Antiword 0.37-18 with AddressSanitizer.
2. Run:
./antiword candidate-A-original.doc
3. AddressSanitizer reports a stack-buffer-overflow in vGet8PapInfo()
at prop8.c:1001.
I have also prepared a candidate patch which adds bounds checks for the
FKP descriptor offsets, iFodo, and record ranges before accessing the
512-byte FKP page or passing data to vGet8StyleInfo().
With the patch applied:
- the reproducer exits without an AddressSanitizer finding;
- a valid .doc test file continues to process successfully; and
- its generated output is byte-for-byte identical to the output from
the unpatched build for that valid test file.
I can provide the crashing .doc reproducer and candidate patch.
-- System Information:
Debian Release: bullseye/sid
APT prefers focal-updates
APT policy: (500, 'focal-updates'), (500, 'focal-security'), (500, 'focal'),
(100, 'focal-backports')
Architecture: amd64 (x86_64)
Kernel: Linux 5.4.0-216-generic (SMP w/4 CPU cores)
Kernel taint flags: TAINT_SOFTLOCKUP
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8
(charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages antiword depends on:
ii libc6 2.31-0ubuntu9.18
antiword recommends no packages.
antiword suggests no packages.
