漏洞概述 在GDAL的vendored HDF-EOS库中，存在一个堆缓冲区溢出漏洞。该漏洞发生在 函数中，具体是在 函数中。当处理HDF-EOS文件时，如果维度名称值未加引号，会导致堆缓冲区溢出。 影响范围 版本：GDAL 3.13.0dev-4c681ad376 提交：4c681ad376 影响： - 立即：堆缓冲区溢出可能导致SIGSEGV，进而导致拒绝服务。 - 潜在：控制堆的COB写入。 - 范围：任何使用GDAL的HDF4/HDF-EOS多维API打开swath格式文件的应用程序。 修复方案 目前页面中未提供具体的修复方案，但建议更新到最新版本或应用官方提供的补丁。 POC代码 利用代码 ASAN输出 ```plaintext ==17859==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x462007e249e at pc 0x732e06225f0 bp 0x7ffe32e06225ec in /usr/include/aarch64-linux-gnu/bits/string_fortified.h:140 WRITE of size 9 at 0x462007e249e thread T0 #0 0x732e06225ec in strcat /usr/include/aarch64-linux-gnu/bits/string_fortified.h:140 #1 0x732e09258c4 in SWinDims /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1880 #2 0x732e0966469 in HDF4SwathGroup::GetDimensions(char const*) const /home/roo/Desktop/gdal/gdal/ #3 0x732e09e9564 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #4 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #5 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #6 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #7 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #8 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #9 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #10 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #11 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #12 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #13 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #14 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #15 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #16 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #17 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #18 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #19 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #20 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #21 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #22 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #23 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #24 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #25 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #26 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #27 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #28 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #29 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #30 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #31 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #32 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #33 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #34 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #35 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #36 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #37 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #38 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #39 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #40 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #41 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #42 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #43 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #44 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #45 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #46 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #47 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #48 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #49 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #50 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/apps/gdalinfo/bin.cpp:1175 #51 0x732e09e9d44 in DumpGroup /home/roo/Desktop/gdal/gdal/app