Project: libxls (libxls/libxls), language: c++
Vulnerability instance: libxls.cve-2018-20452
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/evanmiller/libxls/issues/35
## Description:
Issue: evanmiller/libxls#35
Title: Alloc-Dealloc-Mismatch in read_MSAT_body function
State: closed
Created by: leonzhao7
Created at: 2018-12-23 16:38:43+00:00

Issue Body:
## Test Version
dev version, git clone https://github.com/evanmiller/libxls
## Test Program
`xls2csv [infile]`
## Gdb and Backtrace
```
Reading symbols from xls2csv...done.
(gdb) run xls2csv_ole_read_MSAT_body_687.xls 
Starting program: /var/normal/bin/xls2csv xls2csv_ole_read_MSAT_body_687.xls
FILE: xls2csv_ole_read_MSAT_body_687.xls
*** Error in `/var/normal/bin/xls2csv': free(): invalid next size (normal): 0x0000000000604b10 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff78737e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7ffff787c37a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7ffff788053c]
/var/normal/lib/libxlsreader.so.1(+0x6fdd)[0x7ffff7bccfdd]
/var/normal/lib/libxlsreader.so.1(ole2_open_file+0x47)[0x7ffff7bcd5b7]
/var/normal/lib/libxlsreader.so.1(xls_open_file+0x12)[0x7ffff7bd0a62]
/var/normal/bin/xls2csv[0x400d6a]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff781c830]
/var/normal/bin/xls2csv[0x401139]
======= Memory map: ========
00400000-00402000 r-xp 00000000 08:01 526493                             /var/normal/bin/xls2csv
00601000-00602000 r--p 00001000 08:01 526493                             /var/normal/bin/xls2csv
00602000-00603000 rw-p 00002000 08:01 526493                             /var/normal/bin/xls2csv
00603000-00624000 rw-p 00000000 00:00 0                                  [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0 
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0 
7ffff75e6000-7ffff75fc000 r-xp 00000000 08:01 1053568                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff75fc000-7ffff77fb000 ---p 00016000 08:01 1053568                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff77fb000-7ffff77fc000 rw-p 00015000 08:01 1053568                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff77fc000-7ffff79bc000 r-xp 00000000 08:01 1053530                    /lib/x86_64-linux-gnu/libc-2.23.so
7ffff79bc000-7ffff7bbc000 ---p 001c0000 08:01 1053530                    /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bbc000-7ffff7bc0000 r--p 001c0000 08:01 1053530                    /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bc0000-7ffff7bc2000 rw-p 001c4000 08:01 1053530                    /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bc2000-7ffff7bc6000 rw-p 00000000 00:00 0 
7ffff7bc6000-7ffff7bd5000 r-xp 00000000 08:01 526488                     /var/normal/lib/libxlsreader.so.1.4.0
7ffff7bd5000-7ffff7dd4000 ---p 0000f000 08:01 526488                     /var/normal/lib/libxlsreader.so.1.4.0
7ffff7dd4000-7ffff7dd5000 r--p 0000e000 08:01 526488                     /var/normal/lib/libxlsreader.so.1.4.0
7ffff7dd5000-7ffff7dd7000 rw-p 0000f000 08:01 526488                     /var/normal/lib/libxlsreader.so.1.4.0
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 1053502                    /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fdd000-7ffff7fe0000 rw-p 00000000 00:00 0 
7ffff7ff5000-7ffff7ff7000 rw-p 00000000 00:00 0 
7ffff7ff7000-7ffff7ffa000 r--p 00000000 00:00 0                          [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 1053502                    /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 1053502                    /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff7831428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt
#0  0x00007ffff7831428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff783302a in __GI_abort () at abort.c:89
#2  0x00007ffff78737ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff798ced8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff787c37a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7ffff798d030 "free(): invalid next size (normal)", action=3) at malloc.c:5006
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3867
#5  0x00007ffff788053c in __GI___libc_free (mem=<optimized out>) at malloc.c:2968
#6  0x00007ffff7bccfdd in read_MSAT_body (sectorCount=8388609, sectorOffset=<optimized out>, ole2=0x603420) at src/ole.c:687
#7  read_MSAT (oleh=0x6036e0, ole2=0x603420) at src/ole.c:757
#8  ole2_read_header (ole=ole@entry=0x603420) at src/ole.c:399
#9  0x00007ffff7bcd5b7 in ole2_open_file (file=file@entry=0x7fffffffe71c "xls2csv_ole_read_MSAT_body_687.xls") at src/ole.c:552
#10 0x00007ffff7bd0a62 in xls_open_file (file=0x7fffffffe71c "xls2csv_ole_read_MSAT_body_687.xls", charset=0x4016e5 "UTF-8", outError=outError@entry=0x7fffffffe364)
    at src/xls.c:1471
#11 0x0000000000400d6a in main (argc=2, argv=0x7fffffffe488) at src/xls2csv.c:116

(gdb) f 6
#6  0x00007ffff7bccfdd in read_MSAT_body (sectorCount=8388609, sectorOffset=<optimized out>, ole2=0x603420) at src/ole.c:687
687         free(sector);
```
## Asan Debug Information
```
root@leon-virtual-machine:/var/asan/bin# ./xls2csv xls2csv_ole_read_MSAT_body_687.xls 
FILE: xls2csv_ole_read_MSAT_body_687.xls
=================================================================
==42611==ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new vs free) on 0x61500000fd00
    #0 0x7fd8432c02ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7fd8430012f7 in ole2_read_header src/ole.c:406
    #2 0x7fd843001fd5 in ole2_open_file src/ole.c:552
    #3 0x7fd84301035d in xls_open_file src/xls.c:1471
    #4 0x4016e8 in main src/xls2csv.c:116
    #5 0x7fd842c3b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #6 0x401008 in _start (/var/asan/bin/xls2csv+0x401008)

AddressSanitizer can not describe address in more detail (wild memory access suspected).
SUMMARY: AddressSanitizer: alloc-dealloc-mismatch ??:0 __interceptor_free
==42611==HINT: if you don't care about these warnings you may set ASAN_OPTIONS=alloc_dealloc_mismatch=0
==42611==ABORTING
```
## POC file
[xls2csv_ole_read_MSAT_body_687.zip](https://github.com/leonzhao7/vulnerability/blob/master/xls2csv_ole_read_MSAT_body_687.zip)
## CREDIT
Zhao Liang, Huawei Weiran Labs


Comments:
Comment by evanmiller on 2019-01-15 01:03:31+00:00:
Now known as [CVE-2018-20452](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20452)

---

Comment by evanmiller on 2019-02-11 20:09:13+00:00:
Fixed in 1.5.0, and proof of concept file added to the fuzzing corpus. Closing.

Build script:
# Minimized build script with only core build commands
set -eu
if [ -f ./autogen.sh ]; then
  ./autogen.sh
  ./bootstrap
./configure --enable-static
make clean -j$(nproc)
make -j$(nproc)
make fuzz_xls -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf autoconf-archive automake gettext libtool
RUN git clone https://github.com/libxls/libxls libxls
RUN git -C libxls checkout ab544df742cf50c730d1b6e46c66e44e3e42399f
WORKDIR $SRC/libxls
COPY build.sh $SRC/

Additional files: