CVE-2022-1534: Out-of-bounds Read (CWE-125)
value: Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-04-29T11:15Z
Repository: https://github.com/bfabiszewski/libmobi
Language: Other
Files changed: ChangeLog, src/parse_rawml.c
Commit date: 2022-04-26 15:07:48 +0200
Commit message: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input

Diff: diff --git a/ChangeLog b/ChangeLog
index 2eaf0fa..6a9e42c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,10 +1,11 @@
+2022-04-26: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input
 2022-04-23: Fix formatting
 2022-04-23: Fix checking boundary of deobfuscation key which could cause buffer over-read with corrupt data
 2022-04-23: Fix issue with corrupt data with empty lookup string which could lead to read beyond buffer
-2022-04-23: Fix faulty checks for array boundary which caused buffer over-read
-2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read
+2022-04-23: Fix faulty checks for array boundary which caused buffer over-read with corrupt input
+2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference
 2022-04-23: Fix issues when mobi_buffer_getpointer returns null. With corrupt data this could lead to out-of-bounds read
 2022-04-13: Add packaging status [skip ci]
 2022-04-10: Make random generation return proper error codes
 2022-04-10: Rewrite randombytes for libmobi
 2022-04-07: Add libsodium randombytes.c
diff --git a/src/parse_rawml.c b/src/parse_rawml.c
index 681c665..6b6c9d7 100644
--- a/src/parse_rawml.c
+++ b/src/parse_rawml.c
@@ -1411,10 +1411,14 @@ MOBI_RET mobi_reconstruct_infl(char *outstring, const MOBIIndx *infl, const MOBI
             }
             free(group_name);
             
             unsigned char decoded[INDX_INFLBUF_SIZEMAX + 1];
             memset(decoded, 0, INDX_INFLBUF_SIZEMAX + 1);
+            if (parts[j] >= infl->entries_count) {
+                debug_print("%s\n", "Invalid entry offset");
+                return MOBI_DATA_CORRUPT;
+            }
             unsigned char *rule = (unsigned char *) infl->entries[parts[j]].label;
             memcpy(decoded, label, label_length);
             int decoded_length = (int) label_length;
             MOBI_RET ret = mobi_decode_infl(decoded, &decoded_length, rule);
             if (ret != MOBI_SUCCESS) {

Vulnerable code: 2022-04-23: Fix faulty checks for array boundary which caused buffer over-read
2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused heap buffer over-read
Fixed code: 2022-04-26: Fix array boundary check when parsing inflections which could result in buffer over-read with corrupt input
2022-04-23: Fix faulty checks for array boundary which caused buffer over-read with corrupt input
2022-04-23: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference
            if (parts[j] >= infl->entries_count) {
                debug_print("%s\n", "Invalid entry offset");
                return MOBI_DATA_CORRUPT;
            }