Vulnerability: An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.
Vulnerability ID: CVE-2017-2920
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/libofx/libofx
Published: 2017-10-05
File: lib/ofx_preproc.cpp
Commit message: Fix a buffer overflow.

This is only the minimum workaround to prevent buffer overflow:
Stop iterating once the (fixed!) size of the output buffers is
reached. In response to
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317

However, this code is a huge mess anyway and is in no way
anything like up-to-date C++ code. Please, anyone, replace it
with something more modern. Thanks.
Commit author: Christian Stimming

Vulnerable version (before fix):
 int ofx_proc_file(LibofxContextPtr ctx, const char * p_filename) string sanitize_proprietary_tags(string input_string) {   unsigned int i;   size_t input_string_size;   bool strip = false;   bool tag_open = false;   int tag_open_idx = 0; //Are we within < > ? string sanitize_proprietary_tags(string input_string)     close_tagname[i] = 0;   }    input_string_size = input_string.size();    for (i = 0; i < input_string_size; i++)   {     if (input_string.c_str()[i] == '<')     {

Fixed version (after fix):
 int ofx_proc_file(LibofxContextPtr ctx, const char * p_filename) string sanitize_proprietary_tags(string input_string) {   unsigned int i;   bool strip = false;   bool tag_open = false;   int tag_open_idx = 0; //Are we within < > ? string sanitize_proprietary_tags(string input_string)     close_tagname[i] = 0;   }    size_t input_string_size = input_string.size();    // Minimum workaround to prevent buffer overflow: Stop iterating   // once the (fixed!) size of the output buffers is reached. In   // response to   // https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317   //   // However, this code is a huge mess anyway and is in no way   // anything like up-to-date C++ code. Please, anyone, replace it   // with something more modern. Thanks. - cstim, 2017-09-17.   for (i = 0; i < std::min(input_string_size, size_t(READ_BUFFER_SIZE)); i++)   {     if (input_string.c_str()[i] == '<')     {

Patch:
patch: @@ -417,7 +417,6 @@ int ofx_proc_file(LibofxContextPtr ctx, const char * p_filename)
 string sanitize_proprietary_tags(string input_string)
 {
   unsigned int i;
-  size_t input_string_size;
   bool strip = false;
   bool tag_open = false;
   int tag_open_idx = 0; //Are we within < > ?
@@ -438,9 +437,17 @@ string sanitize_proprietary_tags(string input_string)
     close_tagname[i] = 0;
   }
 
-  input_string_size = input_string.size();
-
-  for (i = 0; i < input_string_size; i++)
+  size_t input_string_size = input_string.size();
+
+  // Minimum workaround to prevent buffer overflow: Stop iterating
+  // once the (fixed!) size of the output buffers is reached. In
+  // response to
+  // https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0317
+  //
+  // However, this code is a huge mess anyway and is in no way
+  // anything like up-to-date C++ code. Please, anyone, replace it
+  // with something more modern. Thanks. - cstim, 2017-09-17.
+  for (i = 0; i < std::min(input_string_size, size_t(READ_BUFFER_SIZE)); i++)
   {
     if (input_string.c_str()[i] == '<')
     {
path: lib/ofx_preproc.cpp