Package: aha
Version: 0.5.1-1
Severity: important
X-Debbugs-Cc: jieyong...@gmail.com
Dear Maintainer,
aha: Buffer overflow in main function at aha.c:973 in aha 0.5.1 allows remote
attackers to cause a denial of service (crash) via a crafted input document.
==Version:==
root@max:/home/fuzz/poc/aha# apt-cache policy antiword
antiword:
Installed: 0.37-16
Candidate: 0.37-16
Version table:
*** 0.37-16 500
500 http://mirrors.ustc.edu.cn/debian bullseye/main amd64 Packages
100 /var/lib/dpkg/status
==Crash:==
root@max:/home/fuzz/poc/aha# aha -f poc.txt
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
<!-- This file was created with the aha Ansi HTML Adapter.
https://github.com/theZiz/aha -->
<html xmlns="http://www.w3.org/1999/xhtml";>
<head>
<meta http-equiv="Content-Type" content="application/xml+xhtml; charset=UTF-8"/>
<title>poc.txt</title>
</head>
<body>
<pre>
Segmentation fault
==Backtraces:==
root@fuzz06:/home/fuzz/fuzz/aha-master# gdb --args ./aha -f
out/fuzzer1/crashes/poc.txt
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.1) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./aha...
(gdb) r
Starting program: /home/fuzz/fuzz/aha-master/aha -f out/fuzzer1/crashes/poc.txt
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd";>
<!-- This file was created with the aha Ansi HTML Adapter.
https://github.com/theZiz/aha -->
<html xmlns="http://www.w3.org/1999/xhtml";>
<head>
<meta http-equiv="Content-Type" content="application/xml+xhtml; charset=UTF-8"/>
<title>out/fuzzer1/crashes/poc.txt</title>
</head>
<body>
<pre>
Program received signal SIGSEGV, Segmentation fault.
0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
973
momelem=momelem->next;
(gdb) bt
#0 0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
(gdb) l
968
state.highlighted = 1;
969
*dest=momelem->value-100;
970
}
971
break;
972 }
973
momelem=momelem->next;
974 }
975 deleteParse(elem);
976 break;
977 case 'H':
(gdb) n
Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
Ref:https://github.com/theZiz/aha/issues/95
-- System Information:
Debian Release: 11.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.0-12-amd64 (SMP w/4 CPU threads)
Locale: LANG=zh_CN.UTF-8, LC_CTYPE=zh_CN.UTF-8 (charmap=UTF-8),
LANGUAGE=zh_CN:zh
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages aha depends on:
ii libc6 2.31-13+deb11u2
aha recommends no packages.
aha suggests no packages.
-- no debconf information
