CVE-2017-2920: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-10-05T19:29Z
Repository: https://github.com/libofx/libofx
Language: C++
Files changed: lib/ofx_preproc.cpp
Commit date: 2017-09-17 21:02:10 +0200
Commit message: Fix a buffer overflow.

This is only the minimum workaround to prevent buffer overflow:
Stop iterating once the (fixed!) size of the output buffers is
reached. In response to
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317

However, this code is a huge mess anyway and is in no way
anything like up-to-date C++ code. Please, anyone, replace it
with something more modern. Thanks.

Diff: diff --git a/lib/ofx_preproc.cpp b/lib/ofx_preproc.cpp
index 30e0d8c..f07f274 100644
--- a/lib/ofx_preproc.cpp
+++ b/lib/ofx_preproc.cpp
@@ -415,11 +415,10 @@ int ofx_proc_file(LibofxContextPtr ctx, const char * p_filename)
 */
 
 string sanitize_proprietary_tags(string input_string)
 {
   unsigned int i;
-  size_t input_string_size;
   bool strip = false;
   bool tag_open = false;
   int tag_open_idx = 0; //Are we within < > ?
   bool closing_tag_open = false; //Are we within </ > ?
   int orig_tag_open_idx = 0;
@@ -436,13 +435,21 @@ string sanitize_proprietary_tags(string input_string)
     buffer[i] = 0;
     tagname[i] = 0;
     close_tagname[i] = 0;
   }
 
-  input_string_size = input_string.size();
-
-  for (i = 0; i < input_string_size; i++)
+  size_t input_string_size = input_string.size();
+
+  // Minimum workaround to prevent buffer overflow: Stop iterating
+  // once the (fixed!) size of the output buffers is reached. In
+  // response to
+  // https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317
+  //
+  // However, this code is a huge mess anyway and is in no way
+  // anything like up-to-date C++ code. Please, anyone, replace it
+  // with something more modern. Thanks. - cstim, 2017-09-17.
+  for (i = 0; i < std::min(input_string_size, size_t(READ_BUFFER_SIZE)); i++)
   {
     if (input_string.c_str()[i] == '<')
     {
       tag_open = true;
       tag_open_idx = i;

Vulnerable code:   size_t input_string_size;
  input_string_size = input_string.size();

  for (i = 0; i < input_string_size; i++)
Fixed code:   size_t input_string_size = input_string.size();

  // Minimum workaround to prevent buffer overflow: Stop iterating
  // once the (fixed!) size of the output buffers is reached. In
  // response to
  // https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317
  //
  // However, this code is a huge mess anyway and is in no way
  // anything like up-to-date C++ code. Please, anyone, replace it
  // with something more modern. Thanks. - cstim, 2017-09-17.
  for (i = 0; i < std::min(input_string_size, size_t(READ_BUFFER_SIZE)); i++)