NULL pointer dereference in fig2dev 3.2.7a

NULL pointer dereference in fig2dev 3.2.7aLoginsoft-2018-1005August 23, 2018

CWE

CWE-476: NULL Pointer Dereference

Product Details

Xfig is a free and open-source vector graphics editor which runs under the X Window System on most UNIX-compatible platforms. fig2dev is a library used by Xfig package to translate fig code to other graphical languages (tikz, shape, jpeg, png etc.)‍

URL: Source forge

Vulnerable Versions

fig2dev 3.2.7a

Vulnerability Details

A NULL pointer dereference was discovered in fig2dev 3.2.7 version.

SYNOPSIS

Similar to #report10, while parsing the .fig file, when it attempts to read the objects, specifically spline object by calling read_splineobject(), inside create_line_with_spline() function is being called by passing in the structure `s` which when used by the compute_open_spline() function which contains few spline drawing routines utilizes a macro COPY_CONTROL_POINT, which attempts to swap few values [1], leaving the value of p2 as NULL.

Later the code in an if block, while dereferencing the p2 structure member `p2->next` [2], a segmentation fault is being triggered as a result of accessing an invalid memory address creating a NULL dereference issue.

Analysis


$rax : 0x0 
$rbx : 0x7fffffffd600 → 0x00007fffffffda40 → 0x00007fffffffda70 → 0x00007fffffffdbd0 → 0x00007fffffffdc00 → 0x00007fffffffdc30 → 0x00007fffffffdd10 → 0x0000000000516090
$rcx : 0x0 
$rdx : 0x0 
$rsp : 0x7fffffffd4e0 → 0x000060800000bf28 → 0x0000000000000000
$rbp : 0x7fffffffd550 → 0x00007fffffffd630 → 0x00007fffffffda70 → 0x00007fffffffdbd0 → 0x00007fffffffdc00 → 0x00007fffffffdc30 → 0x00007fffffffdd10 → 0x0000000000516090
$rsi : 0x0 
$rdi : 0x7ffff715fed0 → 0x0000000000000001
$rip : 0x423650 →  mov rax, QWORD PTR [rax+0x8]


0x423644  mov    rdi, rax
 0x423647  call   0x4022b0 <__asan_report_load8@plt>
 0x42364c  mov    rax, QWORD PTR [rbp-0x30]
→   0x423650  mov    rax, QWORD PTR [rax+0x8]
 0x423654  test   rax, rax
 0x423657  jne    0x42366b 
 0x423659  mov    rax, QWORD PTR [rbp-0x30]
 0x42365d  mov    QWORD PTR [rbp-0x28], rax
 0x423661  mov    rax, QWORD PTR [rbp-0x18]


gef➤  bt 
#0  0x0000000000423650 in compute_open_spline (spline=0x60800000bf20, precision=0.5) at trans_spline.c:193
#1  0x0000000000426667 in create_line_with_spline (s=0x60800000bf20) at trans_spline.c:494
#2  0x0000000000420c76 in read_splineobject (fp=0x61600000fc80) at read.c:1207
#3  0x0000000000419669 in read_objects (fp=0x61600000fc80, obj=0x7fffffffdc80) at read.c:383
#4  0x0000000000418841 in readfp_fig (fp=0x61600000fc80, obj=0x7fffffffdc80) at read.c:172
#5  0x000000000041872a in read_fig (file_name=0x7fffffffe1e9 "/home/woot/Desktop/xfig/ou/crashes/id:000001,sig:11,src:000027,op:flip1,pos:76", obj=0x7fffffffdc80) at read.c:142
#6  0x0000000000410ea4 in main (argc=0x4, argv=0x7fffffffddf8) at fig2dev.c:424

ASAN Output


ASAN:SIGSEGV
=================================================================
==75521==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x00000044562d bp 0x000000000000 sp 0x7fffffffd4d0 T0)
#0 0x44562c (/usr/local/bin/fig2dev+0x44562c)
#1 0x446c68 (/usr/local/bin/fig2dev+0x446c68)
#2 0x43b3db (/usr/local/bin/fig2dev+0x43b3db)
#3 0x43e09f (/usr/local/bin/fig2dev+0x43e09f)
#4 0x404103 (/usr/local/bin/fig2dev+0x404103)
#5 0x7ffff67b782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#6 0x406038 (/usr/local/bin/fig2dev+0x406038)

Proof of concept

fig2dev –L tikz $POC

Timeline

Vendor Disclosure: 2018-08-23

Patch Release: 2018-08-24

Public Disclosure: 2018-08-25

Credit

Discovered by ACE Team - Loginsoft