CVE-2022-4741 (published 2022-12-25T20:15Z)

A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-789
cwe_name: Memory Allocation with Excessive Size Value
description: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/sajari/docconv
commit_details: repo_url: https://github.com/sajari/docconv
author: Helena Mariano
author_date: 2022-07-18 15:47:08+10:00
msg: fix unbounded memory consumption vulnerability (#111)

Co-authored-by: Helena Mariano <31138349+helenamariano@users.noreply.github.com>
repository: repo_url: https://github.com/sajari/docconv
repo_name: sajari/docconv
description: Converts PDF, DOC, DOCX, XML, HTML, RTF, etc to plain text
repo_language: Go
owner: sajari
file_changes: filename: docx.go
change_type: ModificationType.MODIFY
diff: @@ -40,7 +40,7 @@ func ConvertDocx(r io.Reader) (string, map[string]string, error) {
 		size = si.Size()
 		ra = f
 	} else {
-		b, err := ioutil.ReadAll(r)
+		b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 		if err != nil {
 			return "", nil, nil
 		}

programming_language: Go
filename: limit.go
change_type: ModificationType.ADD
diff: @@ -0,0 +1,3 @@
+package docconv
+
+const maxBytes = 20 << 20 // 20MB

programming_language: Batchfile
filename: odt.go
change_type: ModificationType.MODIFY
diff: @@ -14,7 +14,7 @@ func ConvertODT(r io.Reader) (string, map[string]string, error) {
 	meta := make(map[string]string)
 	var textBody string
 
-	b, err := ioutil.ReadAll(r)
+	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 	if err != nil {
 		return "", nil, err
 	}

programming_language: Go
filename: pages.go
change_type: ModificationType.MODIFY
diff: @@ -21,7 +21,7 @@ func ConvertPages(r io.Reader) (string, map[string]string, error) {
 	meta := make(map[string]string)
 	var textBody string
 
-	b, err := ioutil.ReadAll(r)
+	b, err := ioutil.ReadAll(io.LimitReader(r, maxBytes))
 	if err != nil {
 		return "", nil, fmt.Errorf("error reading data: %v", err)
 	}

programming_language: Go
filename: xml.go
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ func ConvertXML(r io.Reader) (string, map[string]string, error) {
 func XMLToText(r io.Reader, breaks []string, skip []string, strict bool) (string, error) {
 	var result string
 
-	dec := xml.NewDecoder(r)
+	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
 	dec.Strict = strict
 	for {
 		t, err := dec.Token()
@@ -76,7 +76,7 @@ func XMLToText(r io.Reader, breaks []string, skip []string, strict bool) (string
 // XMLToMap converts XML to a nested string map.
 func XMLToMap(r io.Reader) (map[string]string, error) {
 	m := make(map[string]string)
-	dec := xml.NewDecoder(r)
+	dec := xml.NewDecoder(io.LimitReader(r, maxBytes))
 	var tagName string
 	for {
 		t, err := dec.Token()

programming_language: Go