You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -63,7 +64,7 @@ Following, on line 471, the length is multiplied by 8, then 8 is subtracted from
63
64
472
64
65
```
65
66
66
-
Following the length remaining calculation, the `command_id` retrieved earlier is used to determine the command type and on line 480, the `dissect_client_transport_info` is called
67
+
Following the length remaining calculation, the `command_id` retrieved earlier is used to determine the command type and on line 480, the `dissect_client_transport_info` is called
@@ -17,7 +18,7 @@ Due to failure in validating the length provided by an attacker-crafted CUPS PPD
17
18
18
19
# Technical Details
19
20
20
-
The `scan_ps` function in the CUPS codebase provides functionality that scans through a string looking for the next Postscript object. When iterating through a string which contains an open parenthesis and ends with a single backslash (0x5c) character, the code incorrectly iterates forward a character without properly checking the bounds of the string resulting in a 1 byte read beyond the allocated heap buffer.
21
+
The `scan_ps` function in the CUPS codebase provides functionality that scans through a string looking for the next Postscript object. When iterating through a string which contains an open parenthesis and ends with a single backslash (0x5c) character, the code incorrectly iterates forward a character without properly checking the bounds of the string resulting in a 1 byte read beyond the allocated heap buffer.
21
22
22
23
Snippet of the vulnerable code:
23
24
@@ -107,7 +108,7 @@ Line 1085 contains the case statement which provides the logic used to iterate t
107
108
108
109
On line 1091, the for loop within the case statement is used to iterate through each character after encountering an open paranthesis character (0x28), storing the pointer to the current character in `cur`.
109
110
110
-
On line 1111, the code checks if the current character is a backslash and finally, in line 1117, the character index is incremented without checking the length, now pointing to the null byte terminating the string.
111
+
On line 1111, the code checks if the current character is a backslash and finally, in line 1117, the character index is incremented without checking the length, now pointing to the null byte terminating the string.
111
112
112
113
Upon the next iteration of the loop, on line 1094, the loop now begins iterating through unallocated memory resulting in undefined behaviour.
113
114
@@ -142,4 +143,3 @@ This issue is being disclosed through the AHA! CNA and is credited to: [zenofex]
Copy file name to clipboardExpand all lines: content/cves/CVE-2023-5841.md
+16-15Lines changed: 16 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,7 @@
1
1
---
2
2
title: CVE-2023-5841
3
3
aliases: ["/cves/CVE-2023-5841.html"]
4
+
pubDate: 2024-01-31T13:37:00-05:00
4
5
---
5
6
6
7
# CVE-2023-5841: Academy Software Foundation OpenEXR Heap Overflow in Scanline Deep Data Parsing
@@ -27,7 +28,7 @@ src/lib/OpenEXRCore/unpack.c
27
28
1214 uint8_t* cdata;
28
29
1215 int w, h, bpc, ubpc;
29
30
1216 size_t totsamps = 0;
30
-
1217
31
+
1217
31
32
...
32
33
...
33
34
1253 for (int x = 0; x < w; ++x)
@@ -38,18 +39,18 @@ src/lib/OpenEXRCore/unpack.c
38
39
1258 {
39
40
1259 int32_t tmp = samps - prevsamps;
40
41
1260 prevsamps = samps;
41
-
1261 samps = tmp;
42
-
1262 }
43
-
1263
42
+
1261 samps = tmp;
43
+
1262 }
44
+
1263
44
45
1264 UNPACK_SAMPLES (samps)
45
-
1265
46
+
1265
46
47
1266 srcbuffer += bpc * samps;
47
48
1267 if (incr_tot) totsamps += (size_t) samps;
48
-
1268 }
49
-
1269 }
49
+
1268 }
50
+
1269 }
50
51
1270 sampbuffer += w;
51
-
1271 }
52
-
1272
52
+
1271 }
53
+
1272
53
54
1273 return EXR_ERR_SUCCESS;
54
55
1274 }
55
56
```
@@ -179,7 +180,7 @@ src/lib/OpenEXRCore/unpack.c
179
180
1090 }
180
181
```
181
182
182
-
This vulernability is by default unreachable through the exr\* utilities provided with
183
+
This vulernability is by default unreachable through the exr\* utilities provided with
183
184
the OpenEXR library because of a conditional in the `checkCoreFile` function (lines 1489-1492 below) which prevent the processing of EXR image files with the `DEEP_SCANLINE`/`DEEP_TILE` storage modes.
184
185
185
186
This however only prevents the exr\* utilities from reaching the vulnerable code and direct calls
0 commit comments