Control: tags -1 -pending
On Mon, Aug 17, 2026 at 02:20:16PM +0000, vulnreport wrote:
> In wordole.c, bGetPPS obtains the name length directly from offset
> 0x40 of the attacker-controlled 128-byte PPS directory entry:
>
> tNameSize = (size_t)usGetWord(0x40, aucBytes);
> tNameSize = (tNameSize + 1) / 2;
> vName2String(atPPSlist[iIndex].szName, aucBytes, tNameSize);
That is what the upstream 0.37 code looks like, but the Debian package
has been patching this since 0.37-5 (2009-06-03) to clamp the value:
tNameSize = (size_t)usGetWord(0x40, aucBytes);
tNameSize = (tNameSize + 1) / 2;
+ if ( tNameSize > sizeof(atPPSlist[iIndex].szName)) {
+ werr(0, "Name Size of PPS %d is too large", iIndex);
+ tNameSize = sizeof(atPPSlist[iIndex].szName);
+ }
vName2String(atPPSlist[iIndex].szName, aucBytes, tNameSize);
See debian/patches/10_fix_buffer_overflow_wordole_c.patch
This problem was rediscovered in 2014 and became CVE-2014-8123 (but we'd
already fixed it in Debian).
Your file does seem to trigger a problem, but I don't think it's what
your analysis suggests as the patch above is in the version you say
you're testing and should address the problem you identified.
If you can see what's going on, please do let me know.
Cheers,
Olly
