CVE-2018-20541 (published 2018-12-28T16:29Z)

There is a heap-based buffer overflow in libxsmm_sparse_csc_reader at generator_spgemm_csc_reader.c in LIBXSMM 1.10, a different vulnerability than CVE-2018-20542 (which is in a different part of the source code and is seen at different addresses).

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/hfp/libxsmm
commit_details: repo_url: https://github.com/hfp/libxsmm
author: Hans Pabst
author_date: 2018-11-26 15:28:03+01:00
msg: Issue #287: made CSR/CSC readers more robust against invalid input (case #1).
repository: repo_url: https://github.com/hfp/libxsmm
repo_name: libxsmm/libxsmm
description: Library for specialized dense and sparse matrix operations, and deep learning primitives.
repo_language: C
owner: hfp
file_changes: filename: common_edge_proxy.h
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,9 @@ static void libxsmm_sparse_csr_reader( const char*    i_csr_file_in,
     } else {
       /* if we are the first line after comment header, we allocate our data structures */
       if ( l_header_read == 0 ) {
-        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
+        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
+            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
+        {
           /* allocate CSC datastructure matching mtx file */
           *o_column_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_element_count));
           *o_row_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_row_count + 1));

programming_language: C
filename: edge_proxy_common.c
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,9 @@ void edge_sparse_csr_reader_double( const char*           i_csr_file_in,
     } else {
       /* if we are the first line after comment header, we allocate our data structures */
       if ( l_header_read == 0 ) {
-        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
+        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
+            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
+        {
           /* allocate CSC datastructure matching mtx file */
           *o_column_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_element_count));
           *o_row_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_row_count + 1));

programming_language: C
filename: pyfr_driver_asp_reg.c
change_type: ModificationType.MODIFY
diff: @@ -75,7 +75,9 @@ int my_csr_reader( const char*           i_csr_file_in,
     } else {
       /* if we are the first line after comment header, we allocate our data structures */
       if ( l_header_read == 0 ) {
-        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
+        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
+            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
+        {
           /* allocate CSC datastructure matching mtx file */
           *o_column_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_element_count));
           *o_row_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_row_count + 1));

programming_language: C
filename: generator_spgemm_csc_reader.c
change_type: ModificationType.MODIFY
diff: @@ -117,7 +117,9 @@ void libxsmm_sparse_csc_reader( libxsmm_generated_code* io_generated_code,
     } else {
       /* if we are the first line after comment header, we allocate our data structures */
       if ( l_header_read == 0 ) {
-        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
+        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
+            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
+        {
           /* allocate CSC data structure matching mtx file */
           *o_row_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_element_count));
           *o_column_idx = (unsigned int*) malloc(sizeof(unsigned int) * ((size_t)(*o_column_count) + 1));
@@ -168,8 +170,8 @@ void libxsmm_sparse_csc_reader( libxsmm_generated_code* io_generated_code,
           return;
         }
         /* adjust numbers to zero termination */
-        l_row--;
-        l_column--;
+        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
+        l_row--; l_column--;
         /* add these values to row and value structure */
         (*o_row_idx)[l_i] = l_row;
         (*o_values)[l_i] = l_value;
@@ -205,4 +207,3 @@ void libxsmm_sparse_csc_reader( libxsmm_generated_code* io_generated_code,
   }
 }
 
-

programming_language: C
filename: generator_spgemm_csr_reader.c
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,9 @@ void libxsmm_sparse_csr_reader( libxsmm_generated_code* io_generated_code,
     } else {
       /* if we are the first line after comment header, we allocate our data structures */
       if ( l_header_read == 0 ) {
-        if ( sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) == 3 ) {
+        if (3 == sscanf(l_line, "%u %u %u", o_row_count, o_column_count, o_element_count) &&
+            0 != *o_row_count && 0 != *o_column_count && 0 != *o_element_count)
+        {
           /* allocate CSC data-structure matching mtx file */
           *o_column_idx = (unsigned int*) malloc(sizeof(unsigned int) * (*o_element_count));
           *o_row_idx = (unsigned int*) malloc(sizeof(unsigned int) * ((size_t)(*o_row_count) + 1));
@@ -129,8 +131,8 @@ void libxsmm_sparse_csr_reader( libxsmm_generated_code* io_generated_code,
           return;
         }
         /* adjust numbers to zero termination */
-        l_row--;
-        l_column--;
+        LIBXSMM_ASSERT(0 != l_row && 0 != l_column);
+        l_row--; l_column--;
         /* add these values to row and value structure */
         (*o_column_idx)[l_i] = l_column;
         (*o_values)[l_i] = l_value;

programming_language: C
filename: version.txt
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-master-1.10-47
+master-1.10-48

programming_language: SQL