CVE-2017-1000211 (published 2017-11-17T15:29Z)

Lynx before 2.8.9dev.16 is vulnerable to a use after free in the HTML parser resulting in memory disclosure, because HTML_put_string() can append a chunk onto itself.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/ThomasDickey/lynx-snapshots
commit_details: repo_url: https://github.com/ThomasDickey/lynx-snapshots
author: Thomas E. Dickey
author_date: 2017-07-05 23:04:01+00:00
msg: snapshot of project "lynx", label v2-8-9dev_15b
repository: repo_url: https://github.com/ThomasDickey/lynx-snapshots
repo_name: ThomasDickey/lynx-snapshots
description: snapshots of releases and interim labels for "lynx"https://invisible-island.net/personal/git-exports.html (no pull requests)
repo_language: C
owner: ThomasDickey
file_changes: filename: CHANGES
change_type: ModificationType.MODIFY
diff: @@ -1,9 +1,11 @@
--- $LynxId: CHANGES,v 1.910 2017/07/05 20:39:40 tom Exp $
+-- $LynxId: CHANGES,v 1.911 2017/07/05 22:23:00 tom Exp $
 ===============================================================================
 Changes since Lynx 2.8 release
 ===============================================================================
 
 2017-07-05 (2.8.9dev.16)
+* add a check to ensure that HTML_put_string() will not append a chunk onto
+  itself (report by Ned Williamson) -TD
 * update et.po, tr.po from
     http://translationproject.org/latest/lynx
 

programming_language: Markdown
filename: lynx-dev.lintian-overrides
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 # Lynx's version-numbering is not understood by lintian, though legal.
-lynx-dev: rc-version-greater-than-expected-version 2.8.9dev.15 > 2.8.9 (consider using 2.8.9~dev.15)
+lynx-dev: rc-version-greater-than-expected-version
 
 # This is intentional because it is referenced from the documentation.
 lynx-dev: extra-license-file usr/share/doc/lynx-dev/COPYING

programming_language: Shell
filename: HTML.c
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 /*
- * $LynxId: HTML.c,v 1.173 2017/07/04 20:05:01 tom Exp $
+ * $LynxId: HTML.c,v 1.174 2017/07/05 22:48:09 tom Exp $
  *
  *		Structured stream to Rich hypertext converter
  *		============================================
@@ -505,6 +505,8 @@ void HTML_put_character(HTStructured * me, int c)
  */
 void HTML_put_string(HTStructured * me, const char *s)
 {
+    HTChunk *target = NULL;
+
 #ifdef USE_PRETTYSRC
     char *translated_string = NULL;
 #endif
@@ -525,15 +527,15 @@ void HTML_put_string(HTStructured * me, const char *s)
 	break;			/* Do Nothing */
 
     case HTML_TITLE:
-	HTChunkPuts(&me->title, s);
+	target = &me->title;
 	break;
 
     case HTML_STYLE:
-	HTChunkPuts(&me->style_block, s);
+	target = &me->style_block;
 	break;
 
     case HTML_SCRIPT:
-	HTChunkPuts(&me->script, s);
+	target = &me->script;
 	break;
 
     case HTML_PRE:		/* Formatted text */
@@ -547,20 +549,20 @@ void HTML_put_string(HTStructured * me, const char *s)
 	break;
 
     case HTML_OBJECT:
-	HTChunkPuts(&me->object, s);
+	target = &me->object;
 	break;
 
     case HTML_TEXTAREA:
-	HTChunkPuts(&me->textarea, s);
+	target = &me->textarea;
 	break;
 
     case HTML_SELECT:
     case HTML_OPTION:
-	HTChunkPuts(&me->option, s);
+	target = &me->option;
 	break;
 
     case HTML_MATH:
-	HTChunkPuts(&me->math, s);
+	target = &me->math;
 	break;
 
     default:			/* Free format text? */
@@ -651,6 +653,15 @@ void HTML_put_string(HTStructured * me, const char *s)
 	    }			/* for */
 	}
     }				/* end switch */
+
+    if (target != NULL) {
+	if (target->data == s) {
+	    CTRACE((tfp, "BUG: appending chunk to itself: `%.*s'\n",
+		    target->size, target->data));
+	} else {
+	    HTChunkPuts(target, s);
+	}
+    }
 #ifdef USE_PRETTYSRC
     if (psrc_convert_string) {
 	psrc_convert_string = FALSE;

programming_language: C