Project: w3m (tats/w3m), language: c++
Vulnerability instance: w3m.cve-2023-38252
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/tats/w3m/issues/270
## Description:
Issue: tats/w3m#270
Title: [BUG] Out of bound read in Strnew_size , Str.c:61
State: closed
Created by: iskindar
Created at: 2023-06-29 11:40:21+00:00

Issue Body:
Hello, I found a out-of-bound read in w3m, function Strnew_size , Str.c:61 while testing my new fuzzer.

## Steps to reproduce

```
export CC=gcc
export CFLAGS="-fsanitize=address -g"
./configure && make -j
./w3m -dump $POC
```
Dockerized reproduce steps (recommended)
```
docker pull debian:11 && docker run -it debian:11 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ make libgc-dev libtinfo-dev -y
git clone https://github.com/tats/w3m && pushd w3m
export CC="gcc -fsanitize=address -g" && ./configure && make -j
wget https://github.com/tats/w3m/files/11905204/poc1.zip && unzip poc1.zip
./w3m -dump ./poc1
```


## Platform

- OS: Debian 11

```
$ cat /etc/issue
Debian GNU/Linux 11 \n \l
```

- w3m latest commit https://github.com/tats/w3m/commit/93ad5ee7da3bb3b6848434f0940321f345b7369c

```
$ ./w3m -version 
w3m version w3m/0.5.3+git20230129, options lang=en,m17n,image,color,ansi-color,mouse,menu,cookie,external-uri-loader,w3mmailer,nntp,gopher,ipv6,alarm,mark
```

## ASAN 

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==85==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7f147749b742 bp 0x000000000080 sp 0x7ffddcd7c740 T0)
==85==The signal is caused by a READ memory access.
==85==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
    #0 0x7f147749b742 in GC_malloc_kind_global (/usr/lib/x86_64-linux-gnu/libgc.so.1+0x19742)
    #1 0x5639c506e050 in Strnew_size /w3m/Str.c:61
    #2 0x5639c507a2fb in wc_conv_to_ces /w3m/libwc/conv.c:70
    #3 0x5639c4fbde57 in _saveBuffer /w3m/file.c:7875
    #4 0x5639c4f6cb97 in do_dump /w3m/main.c:1409
    #5 0x5639c4f65a4d in main /w3m/main.c:1115
    #6 0x7f14772a2d09 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x23d09)
    #7 0x5639c4f69979 in _start (/w3m/w3m+0xb3979)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/lib/x86_64-linux-gnu/libgc.so.1+0x19742) in GC_malloc_kind_global
==85==ABORTING
```

## POC
[poc1.zip](https://github.com/tats/w3m/files/11905204/poc1.zip)



Comments:
Comment by iskindar on 2023-07-06 11:52:56+00:00:
Affected version :

- 0.5.3+git20230129
- 0.5.3+git20230121-1
- 0.5.3+git20230121-2

Not Affected version: < 0.5.3+git20220429-1

---

Comment by rkta on 2023-07-10 11:23:33+00:00:
On Thu, Jun 29, 2023 at 04:40:34AM -0700, Zhijie Zhang wrote:
> Hello, I found a out-of-bound write in w3m,
[Snip]
> ==85==The signal is caused by a READ memory access.

Is it read or write?

Cannot reproduce.


---

Comment by iskindar on 2023-07-10 12:04:56+00:00:
> Is it read or write?

It is read. My fault. 

> Cannot reproduce.

Have you tried the dockerized reproduction steps? I tried it just now, and it worked.

![image-20230710195042030](https://csdn-imgsumbit.oss-cn-beijing.aliyuncs.com/image-20230710195042030.png)

I reduce the input file which is [poc1_trim.zip](https://github.com/tats/w3m/files/12001572/poc1_trim.zip)
Maybe you can try it again? If you reproduce successfully, you may see similar output like below.

![image-20230710200312114](https://csdn-imgsumbit.oss-cn-beijing.aliyuncs.com/image-20230710200312114.png)


Pls told me if it's still not available. 

---

Comment by iskindar on 2023-07-10 12:16:16+00:00:
I tried to reproduce it on Debian stable but also failed. It seems this bug only occurs on some specific OS systems with this PoC. 

---

Comment by rkta on 2023-07-10 12:36:13+00:00:
On Mon, Jul 10, 2023 at 05:16:28AM -0700, Zhijie Zhang wrote:
> I tried to reproduce it on Debian stable but failed. It seems this bug
> only occurs on some specific OS systems.

Then why does your initial report says that OS is Debian 11? Please
provide correct info about the test environment.


---

Comment by iskindar on 2023-07-10 13:33:21+00:00:
Sorry for not making it clear before. 

I can reproduce it on Debian **11** with the following command.
```
docker pull debian:11 && docker run -it debian:11 bash
## now step into the container
...
./w3m -dump ./poc1
```
Since you said that your Debian version is Debian stable in other issues, I tried to reproduce it on **Debian stable** with the following command just now but failed. 
```
docker pull debian:stable && docker run -it debian:stable bash
## now step into the container
...
./w3m -dump ./poc1
```
Actually, the Debian stable in docker images is Debian 12.
```
$ cat /etc/issue
Debian GNU/Linux 12 \n \l
```

So the bug is reproducible at Debian 11 not reproducible at Debian stable (12).
My test environment is Debian 11 as the initial report said.






---

Comment by rkta on 2023-07-11 08:38:58+00:00:
JFTR, I can reproduce it using docker with images debian:11 and
debian:12.

I can not reproduce it on my VPS with Debian 11 nor with Debian 12 and
also not on a laptop running Devuan GNU/Linux 4, which is a Debian 11
without systemd.


---

Comment by pedrohc on 2023-07-13 16:31:29+00:00:
Assigned CVE-2023-38252 for this issue. If you wish to dispute please open a ticket here:
https://access.redhat.com/security/team/contact

---

Comment by rkta on 2023-07-14 05:20:51+00:00:
On Thu, Jul 13, 2023 at 09:31:40AM -0700, Pedro Sampaio wrote:
> Assigned CVE-2023-38252 for this issue. If you wish to dispute please open a ticket here:
> https://access.redhat.com/security/team/contact

This is a READ violation, not write as the CVE states.


---

Comment by pedrohc on 2023-07-14 12:25:33+00:00:
> On Thu, Jul 13, 2023 at 09:31:40AM -0700, Pedro Sampaio wrote: Assigned CVE-2023-38252 for this issue. If you wish to dispute please open a ticket here: https://access.redhat.com/security/team/contact
> This is a READ violation, not write as the CVE states.

Fixed, thanks.

---

Comment by tats on 2023-07-18 12:15:21+00:00:
Prevented with https://github.com/tats/w3m/pull/273


Attachments:
https://github.com/tats/w3m/files/11905204/poc1.zip
https://github.com/tats/w3m/files/12001572/poc1_trim.zip

Commit References:
93ad5ee7da3bb3b6848434f0940321f345b7369c

================= Bug Report (2/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2222775
## Description:
Bugzilla ID: 2222775
Title: CVE-2023-38252 w3m: Out of bounds read in Strnew_size() at w3m/Str.c

Description
Pedro Sampaio 2023-07-13 16:50:57 UTC
w3m 0.5.3+git20230129 has an out-of-bounds read in function Strnew_size in
Str.c. This allows attackers to cause a denial of service via a crafted
HTML file.

Upstream issue:

https://github.com/tats/w3m/issues/270


Comments:
Comment 1
Pedro Sampaio 2023-07-13 16:51:15 UTC
Created w3m tracking bugs for this issue:

Affects: epel-all [bug 2222777]
Affects: fedora-all [bug 2222776]

---

Comment 2
Product Security DevOps Team 2023-07-13 21:42:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-38252

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make myctype.o -j$(nproc)
make Str.o -j$(nproc)
make libwc -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y libgc-dev
RUN git clone https://github.com/tats/w3m w3m
RUN git -C w3m checkout c8223fed7cc631ad85d8e5665e509e7988bedbab
WORKDIR $SRC/w3m
COPY build.sh $SRC/

Additional files: