Bug#968812: antiword: segfault due to an invalid read in vAnalyseDocumentSummaryInfo

[Olly Betts]

On Fri, Aug 21, 2020 at 02:36:28PM +, Luca Borzacchiello wrote:
> running antiword with the attached file leads to an invalid read,
> causing a segfault.

There's no longer an active upstream for antiword.  So while fuzzing it
is great and all, much more useful would be working on patches to fix
the bugs you find by doing it.

Cheers,
Olly

Bug#968812: antiword: segfault due to an invalid read in vAnalyseDocumentSummaryInfo

[Luca Borzacchiello]

Package: antiword
Version: 0.37-16
Severity: normal

Dear Maintainer,
running antiword with the attached file leads to an invalid read, causing a 
segfault.
I used the command line:
antiword ./00_segfault_vAnalyseDocumentSummaryInfo

this is the output of valgrind:
[...]
==716== Invalid read of size 1
==716==at 0x122987: vAnalyseDocumentSummaryInfo (summary.c:280)
==716==by 0x122987: vSetSummaryInfoOLE (summary.c:637)
==716==by 0x11FBED: vGetPropertyInfo (properties.c:145)
==716==by 0x127960: iInitDocumentOLE (wordole.c:792)
==716==by 0x1242D5: bWordDecryptor (word2text.c:665)
==716==by 0x10B6DE: bProcessFile (main_u.c:214)
==716==by 0x10B6DE: main (main_u.c:310)
==716==  Address 0x7ac087b1 is not stack'd, malloc'd or (recently) free'd
==716== 
==716== 
==716== Process terminating with default action of signal 11 (SIGSEGV): dumping 
core
==716==  Access not within mapped region at address 0x7AC087B1
==716==at 0x122987: vAnalyseDocumentSummaryInfo (summary.c:280)
==716==by 0x122987: vSetSummaryInfoOLE (summary.c:637)
==716==by 0x11FBED: vGetPropertyInfo (properties.c:145)
==716==by 0x127960: iInitDocumentOLE (wordole.c:792)
==716==by 0x1242D5: bWordDecryptor (word2text.c:665)
==716==by 0x10B6DE: bProcessFile (main_u.c:214)
==716==by 0x10B6DE: main (main_u.c:310)
[...]

--
Regards,
Luca Borzacchiello

-- System Information:
Debian Release: 10.5
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.4.0-42-generic (SMP w/12 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages antiword depends on:
ii  libc6  2.28-10

antiword recommends no packages.

antiword suggests no packages.

-- no debconf information


00_segfault_vAnalyseDocumentSummaryInfo
Description: MS-Word document