CVE-2023-4508 (published 2023-08-24T23:15Z)

A user able to control file input to Gerbv, between versions 2.4.0 and 2.10.0, can cause a crash and cause denial-of-service with a specially crafted Gerber RS-274X file.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-824
cwe_name: Access of Uninitialized Pointer
description: The product accesses or uses a pointer that has not been initialized.
extended_description: 
            If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks.
            Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.
         
         

Fix information:
repo_url: https://github.com/gerbv/gerbv
commit_details: repo_url: https://github.com/gerbv/gerbv
author: eyal0
author_date: 2023-07-13 11:11:48-06:00
msg: fix: Out-of-bounds memory access of filename.

Put all the filename allocation and deallocation into the `gerb_fopen`
and `gerb_fclose` functions so that the caller doesn't need to deal
with this anymore.

Also, free includeFilename.  It was allocated as part of
`gerb_fgetstring()` above but never freed properly.

Unit tests added to valgrind.
repository: repo_url: https://github.com/gerbv/gerbv
repo_name: gerbv/gerbv
description: Maintained fork of gerbv, carrying mostly bugfixes
repo_language: C
owner: gerbv
file_changes: filename: gerb_file.c
change_type: ModificationType.MODIFY
diff: @@ -131,6 +131,9 @@ gerb_fopen(char const * filename)
 
 #endif
 
+    dprintf("     Setting filename\n");
+    fd->filename = g_strdup(filename);
+
     dprintf("<--- Leaving gerb_fopen\n");
     return fd;
 } /* gerb_fopen */
@@ -238,6 +241,8 @@ void
 gerb_fclose(gerb_file_t *fd)
 {
     if (fd) {
+        g_free(fd->filename);
+
 #ifdef HAVE_SYS_MMAN_H
 	if (munmap(fd->data, fd->datalen) < 0)
 	    GERB_FATAL_ERROR("munmap: %s", strerror(errno));

programming_language: C
filename: gerber.c
change_type: ModificationType.MODIFY
diff: @@ -1476,7 +1476,7 @@ parse_rs274x(gint levelOfRecursion, gerb_file_t *fd, gerbv_image_t *image,
 				"include file recursion which is not allowed "
 				"by the RS-274X spec"));
 		}
-		
+		g_free (includeFilename);
 	    }
 	}
 	break;

programming_language: C
filename: gerbv.c
change_type: ModificationType.MODIFY
diff: @@ -507,9 +507,6 @@ gerbv_open_image(gerbv_project_t *gerbvProject, gchar const* filename, int idx,
 	return -1;
     }
 
-    /* Store filename info fd for further use */
-    fd->filename = g_strdup(filename);
-    
     dprintf("In open_image, successfully opened file.  Now check its type....\n");
     /* Here's where we decide what file type we have */
     /* Note: if the file has some invalid characters in it but still appears to
@@ -578,7 +575,6 @@ gerbv_open_image(gerbv_project_t *gerbvProject, gchar const* filename, int idx,
 	parsed_image = NULL;
     }
     
-    g_free(fd->filename);
     gerb_fclose(fd);
     if (parsed_image == NULL) {
 	return -1;

programming_language: C
filename: parse_aperture_strtok.1.poc
change_type: ModificationType.ADD
diff: @@ -0,0 +1,11 @@
+%FSLAX25Y25*%
+%MOIN*%
+
+%ADD20C,BBBB*%
+
+%IFparse_aperture_strtok.2.poc*%
+
+D21*
+X400000Y400000D03*
+
+M02*

programming_language: Batchfile
filename: parse_aperture_strtok.2.poc
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+M09*
+

programming_language: SQL
filename: run_valgrind_tests.sh
change_type: ModificationType.MODIFY
diff: @@ -2,4 +2,5 @@
 ./run_tests.sh --valgrind \
                example_cslk \
                out-of-bounds-drill-tool \
-               example_am_test
+               example_am_test \
+               parse_aperture_strtok

programming_language: Shell
filename: tests.list
change_type: ModificationType.MODIFY
diff: @@ -182,6 +182,8 @@ test-circular-interpolation-zero-error  |  test-circular-interpolation-zero-erro
 test-merge-a+b_temporary | test-merge-a.gbx test-merge-b.gbx | ! --export=rs274x --output=inputs/test-merge-a+b_temporary.gbx
 test-merge-a+b | test-merge-a+b_temporary.gbx
 
+parse_aperture_strtok | parse_aperture_strtok.1.poc
+
 # ---------------------------------------------
 # Excellon drill tests
 # ---------------------------------------------

programming_language: Shell