CVE-2021-46225: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: A buffer overflow in the GmfOpenMesh() function of libMeshb v7.61 allows attackers to cause a Denial of Service (DoS) via a crafted MESH file.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 6.5
Published: 2022-01-12T20:15Z
Repository: https://github.com/LoicMarechal/libMeshb
Language: Other
Files changed: examples/test_libmeshb_block_pipeline.f, sources/libmeshb7.c
Commit date: 2022-01-07 14:25:30 +0100
Commit message: Removed a potential buffer overflow crash in GmfOpenMesh and debugged the test_libmeshb_block_pipeline.f that crashed

Diff: diff --git a/examples/test_libmeshb_block_pipeline.f b/examples/test_libmeshb_block_pipeline.f
index 940d634..e54a85c 100644
--- a/examples/test_libmeshb_block_pipeline.f
+++ b/examples/test_libmeshb_block_pipeline.f
@@ -1,7 +1,7 @@
 
-c     libmeshb example : transform a quadrilateral mesh into a triangular one
+c     libmeshb example: transform a quadrilateral mesh into a triangular one
 c     using fast block transfer and pipelined post processing
 
       include 'libmeshb7.ins'
 
       external qad2tri, movver
@@ -37,18 +37,19 @@ c     Check memory bounds
 
       print*, 'input mesh  : ',NmbVer,' vertices,',NmbQad,'quads'
 
 c     Read the vertices
       res = gmfgetblock(InpMsh, GmfVertices, 1_8, NmbVer,
-     +                  movver, 1, VerTab,
+     +                  0, %val(0), movver, 1, VerTab,
      +                  GmfDouble, VerTab(1,1), VerTab(1,2),
      +                  GmfDouble, VerTab(2,1), VerTab(2,2),
      +                  GmfDouble, VerTab(3,1), VerTab(3,2),
      +                  GmfInt,    RefTab(1),   RefTab(2))
 
 c     Read the quads
-      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,0,
+      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,
+     +                  0, %val(0), %val(0),
      +                  GmfInt, QadTab(1,1), QadTab(1,2),
      +                  GmfInt, QadTab(2,1), QadTab(2,2),
      +                  GmfInt, QadTab(3,1), QadTab(3,2),
      +                  GmfInt, QadTab(4,1), QadTab(4,2),
      +                  GmfInt, QadTab(5,1), QadTab(5,2))
@@ -77,11 +78,11 @@ c     Then write them down
      +                  GmfInt,    RefTab(1),   RefTab(2))
 
 c     Write the triangles
       res = gmfsetkwd(OutMsh, GmfTriangles, 2*NmbQad, 0, 0)
       res = gmfsetblock(OutMsh, GmfTriangles, 1_8, 2*NmbQad,
-     +                  0,%val(0),%val(0),
+     +                  0,%val(0),
      +                  qad2tri, 2, QadTab, TriTab,
      +                  GmfInt, TriTab(1,1), TriTab(1,2),
      +                  GmfInt, TriTab(2,1), TriTab(2,2),
      +                  GmfInt, TriTab(3,1), TriTab(3,2),
      +                  GmfInt, TriTab(4,1), TriTab(4,2))
diff --git a/sources/libmeshb7.c b/sources/libmeshb7.c
index 8aab88e..a808b4e 100644
--- a/sources/libmeshb7.c
+++ b/sources/libmeshb7.c
@@ -1,17 +1,17 @@
 
 
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
-/*                               LIBMESHB V7.61                               */
+/*                               LIBMESHB V7.62                               */
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
 /*                                                                            */
 /*   Description:        handles .meshb file format I/O                       */
 /*   Author:             Loic MARECHAL                                        */
 /*   Creation date:      dec 09 1999                                          */
-/*   Last modification:  sep 27 2021                                          */
+/*   Last modification:  jan 07 2022                                          */
 /*                                                                            */
 /*----------------------------------------------------------------------------*/
 
 
 /*----------------------------------------------------------------------------*/
@@ -653,11 +653,11 @@ int64_t GmfOpenMesh(const char *FilNam, int mod, ...)
          if(!(msh->hdl = fopen(msh->FilNam, "rb")))
             longjmp(msh->err, -13);
 
          do
          {
-            res = fscanf(msh->hdl, "%s", str);
+            res = fscanf(msh->hdl, "%100s", str);
          }while( (res != EOF) && strcmp(str, "MeshVersionFormatted") );
 
          if(res == EOF)
             longjmp(msh->err, -14);
 
@@ -666,11 +666,11 @@ int64_t GmfOpenMesh(const char *FilNam, int mod, ...)
          if( (msh->ver < 1) || (msh->ver > 4) )
             longjmp(msh->err, -15);
 
          do
          {
-            res = fscanf(msh->hdl, "%s", str);
+            res = fscanf(msh->hdl, "%100s", str);
          }while( (res != EOF) && strcmp(str, "Dimension") );
 
          if(res == EOF)
             longjmp(msh->err, -16);
 
@@ -2537,11 +2537,11 @@ static int ScaKwdTab(GmfMshSct *msh)
    char     str[ GmfStrSiz ];
 
    if(msh->typ & Asc)
    {
       // Scan each string in the file until the end
-      while(fscanf(msh->hdl, "%s", str) != EOF)
+      while(fscanf(msh->hdl, "%100s", str) != EOF)
       {
          // Fast test in order to reject quickly the numeric values
          if(isalpha(str[0]))
          {
             // Search which kwd code this string is associated with, then get its

Vulnerable code: c     libmeshb example : transform a quadrilateral mesh into a triangular one
     +                  movver, 1, VerTab,
      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,0,
     +                  0,%val(0),%val(0),
/*                               LIBMESHB V7.61                               */
/*   Last modification:  sep 27 2021                                          */
            res = fscanf(msh->hdl, "%s", str);
            res = fscanf(msh->hdl, "%s", str);
      while(fscanf(msh->hdl, "%s", str) != EOF)
Fixed code: c     libmeshb example: transform a quadrilateral mesh into a triangular one
     +                  0, %val(0), movver, 1, VerTab,
      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,
     +                  0, %val(0), %val(0),
     +                  0,%val(0),
/*                               LIBMESHB V7.62                               */
/*   Last modification:  jan 07 2022                                          */
            res = fscanf(msh->hdl, "%100s", str);
            res = fscanf(msh->hdl, "%100s", str);
      while(fscanf(msh->hdl, "%100s", str) != EOF)