Heap-buffer-overflow in bits.c:1429

[zodf0055980]

I found a heap buffer overflow in the current master (7f525b9).

Configure

CFLAGS="-g -fsanitize=address" LDFLAGS="-fsanitize=address" ./configure

Command

./dwgbmp ~/poc /dev/null

ASAN report

➜  ./dwgbmp ~/poc /dev/null
=================================================================
==25618==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62c0000301ff at pc 0x7ffff6e91733 bp 0x7fffffffbde0 sp 0x7fffffffb588
READ of size 6 at 0x62c0000301ff thread T0
    #0 0x7ffff6e91732  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732)
    #1 0x7ffff28b0184 in bit_read_fixed /home/yuan/afl-target/libredwg-test/src/bits.c:1429
    #2 0x7ffff299426c in acds_private /home/yuan/afl-target/libredwg-test/src/acds.spec:123
    #3 0x7ffff29b2979 in read_2004_section_acds /home/yuan/afl-target/libredwg-test/src/decode.c:3505
    #4 0x7ffff29c3596 in decode_R2004 /home/yuan/afl-target/libredwg-test/src/decode.c:3769
    #5 0x7ffff28bd6bb in dwg_decode /home/yuan/afl-target/libredwg-test/src/decode.c:245
    #6 0x7ffff2894184 in dwg_read_file /home/yuan/afl-target/libredwg-test/src/dwg.c:253
    #7 0x5555555570bc in get_bmp /home/yuan/afl-target/libredwg-test/programs/dwgbmp.c:120
    #8 0x5555555580c2 in main /home/yuan/afl-target/libredwg-test/programs/dwgbmp.c:301
    #9 0x7ffff1e6bbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #10 0x5555555561b9 in _start (/home/yuan/afl-target/libredwg-test/programs/.libs/dwgbmp+0x21b9)

0x62c0000301ff is located 1 bytes to the left of 29696-byte region [0x62c000030200,0x62c000037600)
allocated by thread T0 here:
    #0 0x7ffff6ef6d28 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xded28)
    #1 0x7ffff2963745 in read_2004_compressed_section /home/yuan/afl-target/libredwg-test/src/decode.c:2492
    #2 0x7ffff29b2504 in read_2004_section_acds /home/yuan/afl-target/libredwg-test/src/decode.c:3491
    #3 0x7ffff29c3596 in decode_R2004 /home/yuan/afl-target/libredwg-test/src/decode.c:3769
    #4 0x7ffff28bd6bb in dwg_decode /home/yuan/afl-target/libredwg-test/src/decode.c:245
    #5 0x7ffff2894184 in dwg_read_file /home/yuan/afl-target/libredwg-test/src/dwg.c:253
    #6 0x5555555570bc in get_bmp /home/yuan/afl-target/libredwg-test/programs/dwgbmp.c:120
    #7 0x5555555580c2 in main /home/yuan/afl-target/libredwg-test/programs/dwgbmp.c:301
    #8 0x7ffff1e6bbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79732) 
Shadow bytes around the buggy address:
  0x0c587fffdfe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c587fffdff0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c587fffe000: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c587fffe010: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c587fffe020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c587fffe030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c587fffe040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c587fffe050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c587fffe060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c587fffe070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c587fffe080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25618==ABORTING

POC

poc.zip

[rurban]

confirmed. dwgbmp not needed, dwgread is enough. missing bounds-check.