CVE-2018-8754 (Other, published 2018-03-18T03:29Z)
Description: value: The libevt_record_values_read_event() function in libevt_record_values.c in libevt before 2018-03-17 does not properly check for out-of-bounds values of user SID data size, strings size, or data size. NOTE: the vendor has disputed this as described in libyal/libevt issue 5 on GitHub
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/libyal/libevt
Files changed:
configure.ac
libevt.nuspec
libevt/libevt_libfvalue.h
libevt/libevt_record_values.c
m4/libcdata.m4
m4/libcsplit.m4
m4/libfdata.m4
runtests.sh
Commit message: Applied updates and addition boundary checks for corrupted data


Vulnerable code:
 [20180125],
dnl Check if libevt should be build with verbose output
AX_COMMON_CHECK_ENABLE_VERBOSE_OUTPUT

dnl Check if libevt should be build with debug output
AX_COMMON_CHECK_ENABLE_DEBUG_OUTPUT

    <version>20180125</version>
    <releaseNotes>Release of libevt 20180125</releaseNotes>
			 &( record_data[ data_offset ] ),
dnl Version: 20170904
dnl Version: 20170903
          csplit,
dnl Version: 20170905
        dnl TODO: add functions
# Version: 20171210

Fixed code:
 [20180317],
dnl Check if verbose output should be enabled
AX_COMMON_CHECK_ENABLE_VERBOSE_OUTPUT

dnl Check if debug output should be enabled
AX_COMMON_CHECK_ENABLE_DEBUG_OUTPUT

    <version>20180317</version>
    <releaseNotes>Release of libevt 20180317</releaseNotes>
#include <libfvalue_data_handle.h>
		if( user_sid_size > ( ( record_data_size - 4 ) - user_sid_offset ) )
		{
			libcerror_error_set(
			 error,
			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
			 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
			 "%s: user SID data size value out of bounds.",
			 function );

			goto on_error;
		}
		if( strings_size > ( ( record_data_size - 4 ) - strings_offset ) )
		{
			libcerror_error_set(
			 error,
			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
			 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
			 "%s: strings size value out of bounds.",
			 function );

			goto on_error;
		}
		if( data_size > ( ( record_data_size - 4 ) - record_data_offset ) )
		{
			libcerror_error_set(
			 error,
			 LIBCERROR_ERROR_DOMAIN_RUNTIME,
			 LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,
			 "%s: data size value out of bounds.",
			 function );

			goto on_error;
		}
			 &( record_data[ record_data_offset ] ),
dnl Version: 20180316
        dnl Balanced tree functions
        AC_CHECK_LIB(
          cdata,
          libfdata_btree_initialize,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_free,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_get_number_of_values,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_get_value_by_index,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_get_value_by_value,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_insert_value,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_replace_value,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])
        AC_CHECK_LIB(
          cdata,
          libcdata_btree_remove_value,
          [ac_cv_libcdata_dummy=yes],
          [ac_cv_libcdata=no])

dnl Version: 20180217
            csplit,
dnl Version: 20180316
        AC_CHECK_LIB(
          fdata,
          libfdata_area_initialize,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_free,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_clone,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_empty,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_resize,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_get_number_of_segments,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_get_segment_by_index,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_set_segment_by_index,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_prepend_segment,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_append_segment,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_get_element_data_size,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_get_element_value_at_offset,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_set_element_value_at_offset,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
        AC_CHECK_LIB(
          fdata,
          libfdata_area_get_size,
          [ac_cv_libfdata_dummy=yes],
          [ac_cv_libfdata=no])
# Version: 20180214
echo "${CONFIGURE_HELP}" | grep -- '--enable-verbose-output' > /dev/null;

HAVE_ENABLE_VERBOSE_OUTPUT=$?;

echo "${CONFIGURE_HELP}" | grep -- '--enable-debug-output' > /dev/null;

HAVE_ENABLE_DEBUG_OUTPUT=$?;

if test ${HAVE_ENABLE_VERBOSE_OUTPUT} -eq 0 && test ${HAVE_ENABLE_DEBUG_OUTPUT} -eq 0;
then
	# Test "./configure && make && make check" with verbose and debug output.

	run_configure_make_check "--enable-verbose-output --enable-debug-output";
	RESULT=$?;

	if test ${RESULT} -ne ${EXIT_SUCCESS};
	then
		exit ${EXIT_FAILURE};
	fi
fi