Project: w3m (tats/w3m), language: c++
Vulnerability instance: w3m.cve-2023-38253
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/tats/w3m/issues/271
## Description:
Issue: tats/w3m#271
Title: [BUG] Out-of-bound read in growbuf_to_Str , indep.c:441
State: closed
Created by: iskindar
Created at: 2023-06-29 12:32:55+00:00

Issue Body:
Hello, I found a out-of-bound read in w3m, function growbuf_to_Str , indep.c:61 while testing my new fuzzer.

## Steps to reproduce


```
docker pull ubuntu:20.04 && docker run -it ubuntu:20.04 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ make libgc-dev libtinfo-dev -y
git clone https://github.com/tats/w3m && pushd w3m
export CC="gcc -fsanitize=address -g" && ./configure && make -j
wget https://github.com/tats/w3m/files/11905598/poc2.zip && unzip poc2.zip
./w3m -dump ./poc2
```



## Platform

- OS: ubuntu 20.04  (not reproducible on Debian 11)

```
$ cat /etc/issue
Ubuntu 20.04.6 LTS \n \l
```

- w3m latest commit https://github.com/tats/w3m/commit/93ad5ee7da3bb3b6848434f0940321f345b7369c

```
$ ./w3m -version 
w3m version w3m/0.5.3+git20230129, options lang=en,m17n,image,color,ansi-color,mouse,menu,cookie,external-uri-loader,w3mmailer,nntp,gopher,ipv6,alarm,mark
```

## ASAN 

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==6186==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f1f28b1e6c3 bp 0x7f1f28b39350 sp 0x7ffc233d2460 T0)
==6186==The signal is caused by a READ memory access.
==6186==Hint: address points to the zero page.
    #0 0x7f1f28b1e6c2 in GC_generic_malloc_inner (/lib/x86_64-linux-gnu/libgc.so.1+0x156c2)
    #1 0x7f1f28b1fc08 in GC_generic_malloc_many (/lib/x86_64-linux-gnu/libgc.so.1+0x16c08)
    #2 0x7f1f28b2b81c in GC_malloc_kind (/lib/x86_64-linux-gnu/libgc.so.1+0x2281c)
    #3 0x560b5fb95165 in growbuf_to_Str /w3m/indep.c:794
    #4 0x560b5fb8c911 in StrISgets2 /w3m/istream.c:238
    #5 0x560b5fac5a5c in loadBuffer /w3m/file.c:7693
    #6 0x560b5faeac5b in loadSomething /w3m/file.c:232
    #7 0x560b5faeac5b in loadGeneralFile /w3m/file.c:2288
    #8 0x560b5fa88807 in main /w3m/main.c:1061
    #9 0x7f1f2890b082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #10 0x560b5fa8c56d in _start (/w3m/w3m+0xb256d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libgc.so.1+0x156c2) in GC_generic_malloc_inner
==6186==ABORTING
```

## POC

[poc2.zip](https://github.com/tats/w3m/files/11905598/poc2.zip)


Comments:
Comment by iskindar on 2023-07-06 11:47:36+00:00:
Affected version :

- 0.5.3+git20230129
- 0.5.3+git20230121-1
- 0.5.3+git20230121-2

Not Affected version: < 0.5.3+git20220429-1

---

Comment by pedrohc on 2023-07-13 16:31:53+00:00:
Assigned CVE-2023-38253 for this issue. If you wish to dispute please open a ticket here:
https://access.redhat.com/security/team/contact

---

Comment by tats on 2023-07-18 12:15:39+00:00:
Prevented with https://github.com/tats/w3m/pull/273


Attachments:
https://github.com/tats/w3m/files/11905598/poc2.zip

Commit References:
93ad5ee7da3bb3b6848434f0940321f345b7369c

================= Bug Report (2/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2222779
## Description:
Bugzilla ID: 2222779
Title: CVE-2023-38253 w3m: Out of bounds read in growbuf_to_Str() at w3m/indep.c

Description
Pedro Sampaio 2023-07-13 16:53:14 UTC
w3m 0.5.3+git20230129 has an out-of-bounds read in function
growbuf_to_Str  in indep.c. This allows attackers to cause a denial of
service via a crafted HTML file.

Upstream issue:

https://github.com/tats/w3m/issues/271


Comments:
Comment 1
Pedro Sampaio 2023-07-13 16:53:31 UTC
Created w3m tracking bugs for this issue:

Affects: epel-all [bug 2222781]
Affects: fedora-all [bug 2222780]

---

Comment 2
Product Security DevOps Team 2023-07-13 21:42:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-38253

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make myctype.o -j$(nproc)
make Str.o -j$(nproc)
make libwc -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y libgc-dev
RUN git clone https://github.com/tats/w3m w3m
RUN git -C w3m checkout c8223fed7cc631ad85d8e5665e509e7988bedbab
WORKDIR $SRC/w3m
COPY build.sh $SRC/

Additional files: