CVE-2018-18584: Out-of-bounds Write (CWE-787)
value: In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.5
Published: 2018-10-23T02:29Z
Repository: https://github.com/kyz/libmspack
Language: Other
Files changed: libmspack/ChangeLog, libmspack/mspack/cab.h
Commit date: 2018-10-17 11:33:35 +0100
Commit message: CAB block input buffer is one byte too small for maximal Quantum block

Diff: diff --git a/libmspack/ChangeLog b/libmspack/ChangeLog
index a5873b6..c677a30 100644
--- a/libmspack/ChangeLog
+++ b/libmspack/ChangeLog
@@ -1,5 +1,13 @@
+2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
+
+	* cab.h: Make the CAB block input buffer one byte larger, to allow
+	a maximum-allowed-size input block and the special extra byte added
+	after the block by cabd_sys_read_block to help Quantum alignment.
+	Thanks to Henri Salo for reporting this.
+
+
 2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>
   
         * chmd_read_headers(): again reject files with blank filenames, this
         time because their 1st or 2nd byte is null, not because their length
         is zero.  Thanks again to Hanno Böck for finding the issue.
diff --git a/libmspack/mspack/cab.h b/libmspack/mspack/cab.h
index c1d48d8..bd234cc 100644
--- a/libmspack/mspack/cab.h
+++ b/libmspack/mspack/cab.h
@@ -1,7 +1,7 @@
 /* This file is part of libmspack.
- * (C) 2003-2004 Stuart Caie.
+ * (C) 2003-2018 Stuart Caie.
  *
  * libmspack is free software; you can redistribute it and/or modify it under
  * the terms of the GNU Lesser General Public License (LGPL) version 2.1
  *
  * For further details, see the file COPYING.LIB distributed with libmspack
@@ -68,10 +68,18 @@
  * block seen in the wild is 337 bytes above uncompressed size.
  */
 #define CAB_BLOCKMAX (32768)
 #define CAB_INPUTMAX (CAB_BLOCKMAX+6144)
 
+/* input buffer needs to be CAB_INPUTMAX + 1 byte to allow for max-sized block
+ * plus 1 trailer byte added by cabd_sys_read_block() for Quantum alignment.
+ *
+ * When MSCABD_PARAM_SALVAGE is set, block size is not checked so can be
+ * up to 65535 bytes, so max input buffer size needed is 65535 + 1
+ */
+#define CAB_INPUTBUF (65535 + 1)
+
 /* There are no more than 65535 data blocks per folder, so a folder cannot
  * be more than 32768*65535 bytes in length. As files cannot span more than
  * one folder, this is also their max offset, length and offset+length limit.
  */
 #define CAB_FOLDERMAX (65535)
@@ -99,11 +107,11 @@ struct mscabd_decompress_state {
   void *state;                       /* decompressor state                   */
   struct mscabd_cabinet_p *incab;    /* cabinet where input data comes from  */
   struct mspack_file *infh;          /* input file handle                    */
   struct mspack_file *outfh;         /* output file handle                   */
   unsigned char *i_ptr, *i_end;      /* input data consumed, end             */
-  unsigned char input[CAB_INPUTMAX]; /* one input block of data              */
+  unsigned char input[CAB_INPUTBUF]; /* one input block of data              */
 };
 
 struct mscab_decompressor_p {
   struct mscab_decompressor base;
   struct mscabd_decompress_state *d;

Vulnerable code:  * (C) 2003-2004 Stuart Caie.
  unsigned char input[CAB_INPUTMAX]; /* one input block of data              */
Fixed code: 2018-10-17  Stuart Caie <kyzer@cabextract.org.uk>

	* cab.h: Make the CAB block input buffer one byte larger, to allow
	a maximum-allowed-size input block and the special extra byte added
	after the block by cabd_sys_read_block to help Quantum alignment.
	Thanks to Henri Salo for reporting this.


 * (C) 2003-2018 Stuart Caie.
/* input buffer needs to be CAB_INPUTMAX + 1 byte to allow for max-sized block
 * plus 1 trailer byte added by cabd_sys_read_block() for Quantum alignment.
 *
 * When MSCABD_PARAM_SALVAGE is set, block size is not checked so can be
 * up to 65535 bytes, so max input buffer size needed is 65535 + 1
 */
#define CAB_INPUTBUF (65535 + 1)

  unsigned char input[CAB_INPUTBUF]; /* one input block of data              */