LibreOffice libxls Buffer Overflow Fix: Offset Validation in Summary Parsing

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Buffer Overflow Affected File: Fix Commit: commit PR Number: #165 "Validate offsets in summary property sets" Status: Merged Scope of Impact Involves offset validation when reading and in the function Affects offset validation for structures such as and in the function Affects the calculation logic for and in the function Fix Solution 1. Add Offset Validation: When reading and , add legitimacy checks for offsets of structures such as and within 2. Add Boundary Checks: In the function, add boundary checks for offsets such as and to prevent out-of-bounds access 3. Add Error Handling: Return or error codes when reading fails POC/Exploitation Code ```c // Code before fix (contains vulnerability) if ((pMB->summary = calloc(1, 4096)) (pMB->docSummary = calloc(1, 4096)) if ((pMB->summary = NULL) (pMB->docSummary = NULL) { retval = LIBXL_ERROR_MALLOC; goto cleanup; } if ((ole2_read(pMB->summary, 4096, 1, pMB->ole) == -1) (ole2_read(pMB->docSummary, 4096, 1, pMB->ole) == -1) { if (xls_debug) fprintf(stderr, "SummaryInformation not found\n"); retval = LIBXL_ERROR_READ; goto cleanup; } // Code after fix (validation added) if ((pMB->summary = calloc(1, XLS_SUMMARY_BUFFER_SIZE)) (pMB->docSummary = calloc(1, XLS_SUMMARY_BUFFER_SIZE)) if ((pMB->summary = NULL) (pMB->docSummary = NULL) { retval = LIBXL_ERROR_MALLOC; goto cleanup; } if ((ole2_read(pMB->summary, XLS_SUMMARY_BUFFER_SIZE, 1, pMB->ole) == -1) (ole2_read(pMB->docSummary, XLS_SUMMARY_BUFFER_SIZE, 1, pMB->ole) == -1) { if (xls_debug) fprintf(stderr, "DocumentSummaryInformation not found\n"); retval = LIBXL_ERROR_READ; goto cleanup; } // Offset validation code if (sectionOffset + offsetOf(sectionHeader, properties) > size) { sectionLength = section->length; if (sectionLength size) { sectionLength = size; } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength - offsetOf(sectionHeader, properties); if (sectionLength < offsetOf(sectionHeader, properties)) { sectionLength = offsetOf(sectionHeader, properties); } sectionLength = sectionLength

Goal Reached Thanks to every supporter — we hit 100%!

LibreOffice libxls Buffer Overflow Fix: Offset Validation in Summary Parsing

More from this source