CVE-2021-26259: Out-of-bounds Write (CWE-787)
value: A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary code execution and denial of service.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2022-03-03T23:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Markdown
Files changed: CHANGES.md, htmldoc/ps-pdf.cxx
Commit date: 2021-04-01 08:14:29 -0400
Commit message: Fix a crash bug with bogus table attributes (Issue #417)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 7d3a7ec9..866b0a53 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,8 +1,9 @@
 # Changes in HTMLDOC v1.9.12
 
 - Fixed a crash bug with "data:" URIs and EPUB output (Issue #410)
+- Fixed a crach bug with bogus table attributes (Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed some issues reported by Coverity.
 
 
diff --git a/htmldoc/ps-pdf.cxx b/htmldoc/ps-pdf.cxx
index 668ec4d6..b8aeb08b 100644
--- a/htmldoc/ps-pdf.cxx
+++ b/htmldoc/ps-pdf.cxx
@@ -6377,10 +6377,13 @@ parse_table(tree_t *t,			// I - Tree to parse
   {
     if (var[strlen((char *)var) - 1] == '%')
       table_width = (float)(atof((char *)var) * (right - left) / 100.0f);
     else
       table_width = (float)(atoi((char *)var) * PagePrintWidth / _htmlBrowserWidth);
+
+    if (table_width < 0.0f || table_width > PagePrintWidth)
+      table_width = right - left;
   }
   else
     table_width = right - left;
 
   if ((var = htmlGetVariable(t, (uchar *)"HEIGHT")) != NULL)
@@ -6394,23 +6397,35 @@ parse_table(tree_t *t,			// I - Tree to parse
     table.height = -1.0f;
 
   DEBUG_printf(("table_width = %.1f\n", table_width));
 
   if ((var = htmlGetVariable(t, (uchar *)"CELLPADDING")) != NULL)
-    table.cellpadding = atoi((char *)var);
+  {
+    if ((table.cellpadding = atoi((char *)var)) < 0.0f)
+      table.cellpadding = 0.0f;
+    else if (table.cellpadding > 20.0f)
+      table.cellpadding = 20.0f;
+  }
   else
     table.cellpadding = 1.0f;
 
   if ((var = htmlGetVariable(t, (uchar *)"CELLSPACING")) != NULL)
-    cellspacing = atoi((char *)var);
+  {
+    if ((cellspacing = atoi((char *)var)) < 0.0f)
+      cellspacing = 0.0f;
+    else if (cellspacing > 20.0f)
+      cellspacing = 20.0f;
+  }
   else
     cellspacing = 0.0f;
 
   if ((var = htmlGetVariable(t, (uchar *)"BORDER")) != NULL)
   {
-    if ((table.border = (float)atof((char *)var)) == 0.0 && var[0] != '0')
+    if ((table.border = (float)atof((char *)var)) <= 0.0 && var[0] != '0')
       table.border = 1.0f;
+    else if (table.border > 20.0f)
+      table.border = 20.0f;
 
     table.cellpadding += table.border;
   }
   else
     table.border = 0.0f;
@@ -6436,11 +6451,11 @@ parse_table(tree_t *t,			// I - Tree to parse
     table.cellpadding += 1.0f;
   }
 
   table.border_size = table.border - 1.0f;
 
-  cellspacing *= PagePrintWidth / _htmlBrowserWidth;
+  cellspacing       *= PagePrintWidth / _htmlBrowserWidth;
   table.cellpadding *= PagePrintWidth / _htmlBrowserWidth;
   table.border      *= PagePrintWidth / _htmlBrowserWidth;
   table.border_size *= PagePrintWidth / _htmlBrowserWidth;
 
   DEBUG_printf(("border = %.1f, cellpadding = %.1f\n", table.border, table.cellpadding));

Vulnerable code:     table.cellpadding = atoi((char *)var);
    cellspacing = atoi((char *)var);
    if ((table.border = (float)atof((char *)var)) == 0.0 && var[0] != '0')
  cellspacing *= PagePrintWidth / _htmlBrowserWidth;
Fixed code: - Fixed a crach bug with bogus table attributes (Issue #417)

    if (table_width < 0.0f || table_width > PagePrintWidth)
      table_width = right - left;
  {
    if ((table.cellpadding = atoi((char *)var)) < 0.0f)
      table.cellpadding = 0.0f;
    else if (table.cellpadding > 20.0f)
      table.cellpadding = 20.0f;
  }
  {
    if ((cellspacing = atoi((char *)var)) < 0.0f)
      cellspacing = 0.0f;
    else if (cellspacing > 20.0f)
      cellspacing = 20.0f;
  }
    if ((table.border = (float)atof((char *)var)) <= 0.0 && var[0] != '0')
    else if (table.border > 20.0f)
      table.border = 20.0f;
  cellspacing       *= PagePrintWidth / _htmlBrowserWidth;