CVE-2016-10375: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in queue/queuepush.c.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-05-26T17:29Z
Repository: https://github.com/fbb-git/yodl
Language: Other
Files changed: yodl/VERSION, yodl/changelog, yodl/src/queue/queuepush.c
Commit date: 2016-02-04 22:37:17 +0100
Commit message: fixed invalid memory reads detected by the address sanitizer

Diff: diff --git a/yodl/VERSION b/yodl/VERSION
index a43d69c..356c0f3 100644
--- a/yodl/VERSION
+++ b/yodl/VERSION
@@ -1,2 +1,2 @@
-#define VERSION "3.06.00"
-#define YEARS   "1996-2015"
+#define VERSION "3.07.00"
+#define YEARS   "1996-2016"
diff --git a/yodl/changelog b/yodl/changelog
index c8d3b64..99bf8f8 100644
--- a/yodl/changelog
+++ b/yodl/changelog
@@ -1,5 +1,14 @@
+yodl (3.07.00)
+
+  * Hanno B\"ock reported an invalid memory read found by the address sanitizer
+    (using -fsanitize=address). Fixed in this release. The address santizer
+    also reported some memory leaks which are not nice, but their fix will
+    probably take some more time.
+
+ -- Frank B. Brokken <f.b.brokken@rug.nl>  Thu, 04 Feb 2016 22:35:44 +0100
+
 yodl (3.06.00)
 
   * The title, author, date and affiliation elements in html document headers
     have received CSS id selectors (respectively 'title', 'author', 'date' and
     'affiliation') which can be used to tune the way these elements are
diff --git a/yodl/src/queue/queuepush.c b/yodl/src/queue/queuepush.c
index 378dc44..03cff1d 100644
--- a/yodl/src/queue/queuepush.c
+++ b/yodl/src/queue/queuepush.c
@@ -27,12 +27,15 @@ void queue_push(register Queue *qp, size_t extra_length, char const *info)
     if (message_show(MSG_INFO))
         message("push_front %u bytes in `%s'", (unsigned)extra_length, info);
 
     if (extra_length > available_length)
     {
+        size_t original_length = memory_length;
+
                                                    /* enlarge the buffer:  */
         memory_length += extra_length - available_length + BLOCK_QUEUE;
+
         cp = new_memory(memory_length, sizeof(char));
 
         if (message_show(MSG_INFO))
             message("Reallocating queue at %p to %p", qp->d_memory, cp);
 
@@ -46,11 +49,11 @@ void queue_push(register Queue *qp, size_t extra_length, char const *info)
             qp->d_write = cp + q_length;
             qp->d_read = cp;
         }
         else                                        /* q as one block       */
         {
-            memcpy(cp, qp->d_memory, memory_length);/* cp existing buffer   */
+            memcpy(cp, qp->d_memory, original_length);/* cp existing buffer   */
             qp->d_read = cp + (qp->d_read - qp->d_memory);
             qp->d_write = cp + (qp->d_write - qp->d_memory);
         }
 
         free(qp->d_memory);                         /* free old memory      */

Vulnerable code: #define VERSION "3.06.00"
#define YEARS   "1996-2015"
            memcpy(cp, qp->d_memory, memory_length);/* cp existing buffer   */
Fixed code: #define VERSION "3.07.00"
#define YEARS   "1996-2016"
yodl (3.07.00)

  * Hanno B\"ock reported an invalid memory read found by the address sanitizer
    (using -fsanitize=address). Fixed in this release. The address santizer
    also reported some memory leaks which are not nice, but their fix will
    probably take some more time.

 -- Frank B. Brokken <f.b.brokken@rug.nl>  Thu, 04 Feb 2016 22:35:44 +0100

        size_t original_length = memory_length;


            memcpy(cp, qp->d_memory, original_length);/* cp existing buffer   */