Vulnerability: An issue was discovered in pixHtmlViewer in prog/htmlviewer.c in Leptonica before 1.75.3. Unsanitized input (rootname) can overflow a buffer, leading potentially to arbitrary code execution or possibly unspecified other impact.
Vulnerability ID: CVE-2018-7247
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/DanBloomberg/leptonica
Published: 2018-02-19
File: prog/htmlviewer.c
Commit message: prog/htmlviewer: Catch unbound memory access (CID 1386222)

rootname can have any size, so limit the amount of copied bytes.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Commit author: Stefan Weil

Vulnerable version (before fix):
 SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;         return ERROR_INT("safiles not made", procName, 1);          /* Generate output text file names */     sprintf(charbuf, "%s/%s.html", dirout, rootname);     mainname = stringNew(charbuf);     sprintf(charbuf, "%s/%s-links.html", dirout, rootname);     linkname = stringNew(charbuf);     linknameshort = stringJoin(rootname, "-links.html");  SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;         pixGetDimensions(pix, &w, NULL, &d);         factor = (l_float32)thumbwidth / (l_float32)w;         pixthumb = pixScale(pix, factor, factor);         sprintf(charbuf, "%s_thumb_%03d", rootname, index);         sarrayAddString(sathumbs, charbuf, L_COPY);         outname = genPathname(dirout, charbuf);         WriteFormattedPix(outname, pixthumb);

Fixed version (after fix):
 SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;         return ERROR_INT("safiles not made", procName, 1);          /* Generate output text file names */     snprintf(charbuf, sizeof(charbuf), "%s/%s.html", dirout, rootname);     mainname = stringNew(charbuf);     snprintf(charbuf, sizeof(charbuf), "%s/%s-links.html", dirout, rootname);     linkname = stringNew(charbuf);     linknameshort = stringJoin(rootname, "-links.html");  SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;         pixGetDimensions(pix, &w, NULL, &d);         factor = (l_float32)thumbwidth / (l_float32)w;         pixthumb = pixScale(pix, factor, factor);         snprintf(charbuf, sizeof(charbuf), "%s_thumb_%03d", rootname, index);         sarrayAddString(sathumbs, charbuf, L_COPY);         outname = genPathname(dirout, charbuf);         WriteFormattedPix(outname, pixthumb);

Patch:
patch: @@ -171,9 +171,9 @@ SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;
         return ERROR_INT("safiles not made", procName, 1);
 
         /* Generate output text file names */
-    sprintf(charbuf, "%s/%s.html", dirout, rootname);
+    snprintf(charbuf, sizeof(charbuf), "%s/%s.html", dirout, rootname);
     mainname = stringNew(charbuf);
-    sprintf(charbuf, "%s/%s-links.html", dirout, rootname);
+    snprintf(charbuf, sizeof(charbuf), "%s/%s-links.html", dirout, rootname);
     linkname = stringNew(charbuf);
     linknameshort = stringJoin(rootname, "-links.html");
 
@@ -197,7 +197,7 @@ SARRAY    *safiles, *sathumbs, *saviews, *sahtml, *salink;
         pixGetDimensions(pix, &w, NULL, &d);
         factor = (l_float32)thumbwidth / (l_float32)w;
         pixthumb = pixScale(pix, factor, factor);
-        sprintf(charbuf, "%s_thumb_%03d", rootname, index);
+        snprintf(charbuf, sizeof(charbuf), "%s_thumb_%03d", rootname, index);
         sarrayAddString(sathumbs, charbuf, L_COPY);
         outname = genPathname(dirout, charbuf);
         WriteFormattedPix(outname, pixthumb);
path: prog/htmlviewer.c