GDAL 堆缓冲区溢出漏洞总结 漏洞概述 GDAL 的 vendored HDF-EOS 库中存在一个堆缓冲区溢出漏洞，原因是 函数在处理未加引号的 值时，使用了 进行字符串拼接，但没有进行边界检查。 漏洞位置: 函数 触发条件: 当 HDF-EOS 文件中的 值未加引号时， 会写入完整的字段名长度，导致堆缓冲区溢出。 根本原因: 函数在分配缓冲区时，假设每个 值都是双引号括起来的，因此减去了 2 个字节。当 值未加引号时， 和 会增长，导致缓冲区分配不足。 影响范围 版本: GDAL 3.13.0dev-4ce81ad376 Commit: 4c681ad376 潜在影响: - 立即影响：堆缓冲区溢出导致拒绝服务（DoS） - 潜在影响：控制堆对象写入 - 范围：任何使用 GDAL 的 HDF4 / HDF-EOS 多维数据集打开网格格式文件的应用程序 修复方案 修复状态: 未提供具体修复方案，但建议检查并修复 函数中的字符串拼接逻辑，确保在拼接字符串时进行边界检查。 POC 代码 ASAN 输出 ```plaintext ==61587==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60ba730e25f8 at pc 0x7f98a3e225f8 bp 0x7ffd5a3e25f0 sp 0x7ffd5a3e25e0 WRITE of size 9 at 0x60ba730e25f8 thread T0 #0 0x7f98a3e225f8 in __interceptor_strcat (/usr/lib/x86_64-linux-gnu/libasan.so.6+0x5e5f8) #1 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #2 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #3 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #4 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #5 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #6 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #7 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #8 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #9 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #10 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #11 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #12 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #13 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #14 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #15 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #16 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #17 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #18 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #19 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #20 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #21 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #22 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #23 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #24 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #25 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #26 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #27 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #28 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #29 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #30 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #31 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #32 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #33 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #34 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #35 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #36 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #37 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #38 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #39 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #40 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #41 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #42 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #43 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #44 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #45 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #46 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinfo.cpp:1175 #47 0x7f98a3e225f8 in GDalInfoFields /home/robert/Desktop/gdal/gdal/apps/gdalinf