On Mon, Oct 09, 2023 at 10:57:46PM +0100, Tj wrote:
> As requested here's a summary of one potential unsanitised input data
> issue that may be leading to this (or other) error(s).
>
> `vSetSummaryInfoOLE()` calls `pucAnalyseSummaryInfoHeader()` that does:
>
> `if (!bReadBuffer(pFile, ... aucBuffer, ...) ... return aucBuffer;`
>
> and then calls `vAnalyseSummaryInfo(pucBuffer)`
>
> - there-in if `ulOffset` is especially large the following:
>
> `tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);`
>
> could be outside of `aucBuffer` since the size of the buffer is not
> passed to this function and therefore cannot be checked.
Thanks.
It looks like it needs to return tLength along with aucBuffer and
check accesses against that. I'll take a look at doing that.
It'd still be helpful to have the "vAnalyseSummaryInfo.poc.doc" file
to reproduce the reported crash as without that we can't test any
fix actually addresses the bug reported here.
I've cc-ed the reporter - hopefully they'll see it this time and
provide that file.
Cheers,
Olly
