CVE-2017-6309 (published 2017-02-24T04:59Z)

An issue was discovered in tnef before 1.4.13. Two type confusions have been identified in the parse_file() function. These might lead to invalid read and write operations, controlled by an attacker.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/verdammelt/tnef
commit_details: repo_url: https://github.com/verdammelt/tnef
author: Eric Sesterhenn
author_date: 2017-02-19 19:36:35+01:00
msg: Check types to avoid invalid reads/writes.
repository: repo_url: https://github.com/verdammelt/tnef
repo_name: verdammelt/tnef
description: tnef
repo_language: C
owner: verdammelt
file_changes: filename: file.c
change_type: ModificationType.MODIFY
diff: @@ -173,11 +173,13 @@ file_add_mapi_attrs (File* file, MAPI_Attr** attrs)
 	    switch (a->name)
 	    {
 	    case MAPI_ATTACH_LONG_FILENAME:
+		assert(a->type == szMAPI_STRING);
 		if (file->name) XFREE(file->name);
 		file->name = strdup( (char*)a->values[0].data.buf );
 		break;
 
 	    case MAPI_ATTACH_DATA_OBJ:
+		assert((a->type == szMAPI_BINARY) || (a->type == szMAPI_OBJECT));
 		file->len = a->values[0].len;
 		if (file->data) XFREE (file->data);
 		file->data = CHECKED_XMALLOC (unsigned char, file->len);
@@ -185,12 +187,14 @@ file_add_mapi_attrs (File* file, MAPI_Attr** attrs)
 		break;
 
              case MAPI_ATTACH_MIME_TAG:
+		assert(a->type == szMAPI_STRING);
 		if (file->mime_type) XFREE (file->mime_type);
 		file->mime_type = CHECKED_XMALLOC (char, a->values[0].len);
 		memmove (file->mime_type, a->values[0].data.buf, a->values[0].len);
 		break;
 
                 case MAPI_ATTACH_CONTENT_ID:
+                    assert(a->type == szMAPI_STRING);
                     if (file->content_id) XFREE(file->content_id);
                     file->content_id = CHECKED_XMALLOC (char, a->values[0].len);
                     memmove (file->content_id, a->values[0].data.buf, a->values[0].len);

programming_language: C
filename: tnef.c
change_type: ModificationType.MODIFY
diff: @@ -165,10 +165,12 @@ get_html_data (MAPI_Attr *a)
     int j;
     for (j = 0; j < a->num_values; j++)
     {
-	body[j] = XMALLOC(VarLenData, 1);
-	body[j]->len = a->values[j].len;
-	body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
-	memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
+        if (a->type == szMAPI_BINARY) {
+ 	    body[j] = XMALLOC(VarLenData, 1);
+	    body[j]->len = a->values[j].len;
+	    body[j]->data = CHECKED_XCALLOC(unsigned char, a->values[j].len);
+	    memmove (body[j]->data, a->values[j].data.buf, body[j]->len);
+        }
     }
     return body;
 }
@@ -306,13 +308,13 @@ parse_file (FILE* input_file, char* directory,
 		    for (i = 0; mapi_attrs[i]; i++)
 		    {
 			MAPI_Attr *a = mapi_attrs[i];
-			    
-			if (a->name == MAPI_BODY_HTML)
+		
+			if (a->type == szMAPI_BINARY && a->name == MAPI_BODY_HTML)
 			{
 			    body.html_bodies = get_html_data (a);
                                 html_size = a->num_values;
 			}
-			else if (a->name == MAPI_RTF_COMPRESSED)
+			else if (a->type == szMAPI_BINARY && a->name == MAPI_RTF_COMPRESSED)
 			{
 			    body.rtf_bodies = get_rtf_data (a);
                                 rtf_size = a->num_values;

programming_language: C