Project: w3m (tats/w3m), language: c++
Vulnerability instance: w3m.cve-2023-4255
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/tats/w3m/issues/268
## Description:
Issue: tats/w3m#268
Title: Incomplete fix for CVE-2022-38223
State: closed
Created by: iskindar
Created at: 2023-06-12 04:16:49+00:00

Issue Body:
Hi, 
I think the fix for  [CVE-2022-38223](https://github.com/advisories/GHSA-rf3p-g68h-h93f) in [419ca82](https://github.com/tats/w3m/commit/419ca82d57c72242817b55e2eaa4cdbf6916e7fa) is not complete and it is still possible to trigger the same bug with a different poc in [tats/w3m#242](https://github.com/tats/w3m/issues/242). The bug is an out of bound write in checkType, etc.c:478. 

## Version
w3m latest commit [93ad5ee](https://github.com/tats/w3m/commit/93ad5ee7da3bb3b6848434f0940321f345b7369c)
```
./w3m --version
w3m version w3m/0.5.3+git20230129, options lang=en,m17n,image,color,ansi-color,mouse,menu,cookie,external-uri-loader,w3mmailer,nntp,gopher,ipv6,alarm,mark
```
## How to reproduce

```
export CC="gcc -fsanitize=address -g"  && ./configure && make -j
./w3m -dump $POC
```
ubuntu 20.04 dockerized reproduce steps
```
docker pull ubuntu:20.04 && docker run -it ubuntu:20.04 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ make libgc-dev libtinfo-dev -y
git clone https://github.com/tats/w3m && pushd w3m
export CC="gcc -fsanitize=address -g" && ./configure && make -j
wget https://github.com/tats/w3m/files/11966800/poc0.zip && unzip poc0.zip
./w3m -dump ./poc0
```
Debian 11 dockerized reproduce steps
```
docker pull debian:11 && docker run -it debian:11 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ make libgc-dev libtinfo-dev -y
git clone https://github.com/tats/w3m && pushd w3m
export CC="gcc -fsanitize=address -g" && ./configure && make -j
wget https://github.com/tats/w3m/files/11967522/poc0_debian.zip && unzip poc0_debian.zip
./w3m -dump ./poc0
```
## ASAN log
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==5589==ERROR: AddressSanitizer: SEGV on unknown address 0x55e29237fe3c (pc 0x55e37f25f7d5 bp 0x55e29237fe3c sp 0x7fffda0d3220 T0)
==5589==The signal is caused by a WRITE memory access.
    #0 0x55e37f25f7d4 in checkType /benchmark/w3m/etc.c:478
    #1 0x55e37f225e8f in loadBuffer /benchmark/w3m/file.c:7727
    #2 0x55e37f24ac5b in loadSomething /benchmark/w3m/file.c:232
    #3 0x55e37f24ac5b in loadGeneralFile /benchmark/w3m/file.c:2288
    #4 0x55e37f1e8807 in main /benchmark/w3m/main.c:1061
    #5 0x7f216f6dd082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #6 0x55e37f1ec56d in _start (/benchmark/w3m/w3m+0xb256d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /benchmark/w3m/etc.c:478 in checkType
==5589==ABORTING

```
## Platform
- OS: ubuntu 20.04.5  LTS
- gcc 9.4.0
or 
- OS : Debian GNU/Linux 11
- gcc 10.2.1

The bug was found by my fuzzer on Ubuntu 20.04.5. In addition, the bug can also be reproduced on Debian 11 with the default version of gcc. 
## PoC 
[ubuntu poc0.zip](https://github.com/tats/w3m/files/11966800/poc0.zip)
[debian poc0.zip](https://github.com/tats/w3m/files/11967522/poc0_debian.zip)

PS: The poc is different from that of   [tats/w3m#242](https://github.com/tats/w3m/issues/242) . 





Comments:
Comment by iskindar on 2023-07-06 11:26:36+00:00:
Affected version : 
- 0.5.3+git20230129
- 0.5.3+git20230121-1
- 0.5.3+git20230121-2

Not Affected version: < 0.5.3+git20220429-1

---

Comment by rkta on 2023-07-10 10:17:59+00:00:
Introduced in

commit 419ca82d57c72242817b55e2eaa4cdbf6916e7fa (HEAD, refs/bisect/bad)
Author: Tatsuya Kinoshita ***@***.***>
Date:   2022-12-20T21:16:48+09:00

    Fix m17n backspace handling causes out-of-bounds write in checkType

    [CVE-2022-38223]
    Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019599
    Bug-Debian: https://github.com/tats/w3m/issues/242


In function checkType in line 386 plens pointer goes out of bounds.
Garbage is assigned to plen, this garbage is subtracted from prop and
prop is later derefenced which leads to the SIGSEV.

(The poc file is full of backspaces.)


---

Comment by rkta on 2023-07-12 08:44:53+00:00:
From how I understand the code, plen is the length of the current (or
previous?) character. In order to process backspace chars correctly over
multi-char characters we store the length of each character in
plens_buffer. When reaching a backspace we pop the last length from the
array.

Now, if we get more backspace chars than we have characters processed
the pointer will go out of bounds.

Below is a fix which prevents the pointer from going out of bounds and
setting plen to 0 when there is nothing left to process.

This also fixes [BUG] Out of bound read in Strnew_size , Str.c:61 #270

diff --git a/etc.c b/etc.c
index 128717b1..efcfab92 100644
--- a/etc.c
+++ b/etc.c
@@ -393,7 +393,8 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    plens = plens == plens_buffer ? plens : plens - 1;
+			    plen = *plens;
 			    str += 2;
 			}
 		    }
@@ -419,7 +420,8 @@ checkType(Str s, Lineprop **oprop, Linecolor **ocolor)
 			    if (color)
 				color -= plen;
 #endif
-			    plen = *(--plens);
+			    plens = plens == plens_buffer ? plens : plens - 1;
+			    plen = *plens;
 			    str++;
 			}
 #else


---

Comment by tats on 2023-07-12 13:59:37+00:00:
@rkta
Could you please create a pull request?


---

Comment by rkta on 2023-07-13 08:55:41+00:00:
On Wed, Jul 12, 2023 at 06:59:48AM -0700, Tatsuya Kinoshita wrote:
> @rkta
> Could you please create a pull request?

See https://github.com/tats/w3m/pull/273


---

Comment by tats on 2023-07-18 12:13:22+00:00:
Fixed with https://github.com/tats/w3m/pull/273


---

Comment by carnil on 2023-12-22 16:21:28+00:00:
This has recieved a separate CVE: CVE-2023-4255

---

Comment by rkta on 2023-12-28 19:03:06+00:00:
On Fri, Dec 22, 2023 at 08:21:39AM -0800, Salvatore Bonaccorso wrote:
> This has recieved a separate CVE: CVE-2023-4255

Did you mean to add this to #282? It's not sure to me what the new CVE
is about.


Attachments:
https://github.com/tats/w3m/files/11967522/poc0_debian.zip
https://github.com/tats/w3m/files/11966800/poc0.zip

Commit References:
419ca82d57c72242817b55e2eaa4cdbf6916e7fa
93ad5ee7da3bb3b6848434f0940321f345b7369c

================= Bug Report (2/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2255207
## Description:
Bugzilla ID: 2255207
Title: CVE-2023-4255 w3m: out-of-bounds write in function checkType() in etc.c (incomplete fix for CVE-2022-38223)

Description
TEJ RATHI 2023-12-19 10:31:11 UTC
w3m has an out-of-bounds write in function checkType() in etc.c. It allows a local attacker to cause Denial of Service or possibly have unspecified other impact via a crafted HTML file. NOTE: It was introduced in the fix of CVE-2022-38223.

Affects: w3m 0.5.3+git20230129, 0.5.3+git20230121-1, 0.5.3+git20230121-2
Not Affected version: < 0.5.3+git20220429-1

https://github.com/tats/w3m/issues/268
https://github.com/tats/w3m/pull/273


Comments:
Comment 1
TEJ RATHI 2023-12-19 10:31:45 UTC
Created w3m tracking bugs for this issue:

Affects: epel-all [bug 2255209]
Affects: fedora-all [bug 2255208]

---

Comment 2
TEJ RATHI 2023-12-19 10:40:42 UTC
Upstream Commit:
https://github.com/tats/w3m/commit/edc602651c506aeeb60544b55534dd1722a340d3

---

Comment 3
Rene Kita 2023-12-22 10:26:37 UTC
What's the relevance of the upstream commit here?

Is this about https://github.com/tats/w3m/issues/282 which is addressed in https://github.com/tats/w3m/pull/285 ?

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make myctype.o -j$(nproc)
make Str.o -j$(nproc)
make libwc -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y libgc-dev
RUN git clone https://github.com/tats/w3m w3m
RUN git -C w3m checkout 93ad5ee7da3bb3b6848434f0940321f345b7369c
WORKDIR $SRC/w3m
COPY build.sh $SRC/

Additional files: