#1008092 antiword: Buffer overflow in the vAnalyseSummaryInfo function in summary.c in Antiword 0.37

Package:
antiword
Source:
antiword
Description:
Converts MS Word files to text, PS, PDF and XML
Submitter:
"Jieyong Ma @ tdhxkj.com"
Date:
2026-08-24 22:43:02 UTC
Severity:
normal
Tags:
#1008092#5
Date:
2022-03-22 10:56:23 UTC
From:
To:
Dear Maintainer,

Description of problem:
antiword crashes with the provided doc file

How reproducible:
antiword vAnalyseSummaryInfo.poc.doc

Backtraces:
Program received signal SIGSEGV, Segmentation fault.
0x0000000000449515 in vAnalyseSummaryInfo (aucBuffer=0x6928f0 "t\001") at summary.c:225
225			switch (tPropID) {
(gdb) bt
#0  0x0000000000449515 in vAnalyseSummaryInfo (aucBuffer=0x6928f0 "t\001") at summary.c:225
#1  vSetSummaryInfoOLE (pFile=0x68f2e0, pFile@entry=0x37, pPPS=0x7fffffffbb10, pPPS@entry=0x68f2e0, aulBBD=0x68fb00, aulBBD@entry=0x7fffffffbb80, tBBDLen=55, tBBDLen@entry=37, aulSBD=aulSBD@entry=0x68fe80, tSBDLen=tSBDLen@entry=2)
    at summary.c:628
#2  0x0000000000449bcf in vSet8SummaryInfo (pFile=0xff7f013c, pFile@entry=0x68f2e0, pPPS=0x692a08, pPPS@entry=0x7fffffffbb10, aulBBD=0xb, aulBBD@entry=0x68fb00, tBBDLen=10, tBBDLen@entry=55, aulSBD=0x692820, aulSBD@entry=0x68fe80,
    tSBDLen=29113347658312010, tSBDLen@entry=2, aucHeader=0x2 <error: Cannot access memory at address 0x2>) at summary.c:686
#3  0x0000000000442126 in vGetPropertyInfo (pFile=pFile@entry=0x68f2e0, pPPS=0x7fffffffbb10, pPPS@entry=0x7fffffffbb00, aulBBD=aulBBD@entry=0x68fb00, tBBDLen=<optimized out>, tBBDLen@entry=55, aulSBD=0x68fe80, aulSBD@entry=0x68fb00,
    tSBDLen=2, tSBDLen@entry=0, aucHeader=0x7fffffffbb80 "\354\245\301", iWordVersion=8) at properties.c:145
#4  0x0000000000458464 in iInitDocumentOLE (pFile=<optimized out>, pFile@entry=0x68f2e0, lFilesize=<optimized out>, lFilesize@entry=28672) at wordole.c:792
#5  0x00000000004552fb in iInitDocument (pFile=<optimized out>, pFile@entry=0x68f2e0, lFilesize=<optimized out>, lFilesize@entry=28672) at wordlib.c:325
#6  0x000000000044ce1f in bWordDecryptor (pFile=pFile@entry=0x68f2e0, lFilesize=lFilesize@entry=28672, pDiag=0x68fac0) at word2text.c:665
#7  0x0000000000403ef3 in bProcessFile (szFilename=<optimized out>) at main_u.c:214
#8  main (argc=2, argv=0x7fffffffe558) at main_u.c:310

Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2064638
#1008092#10
Date:
2022-03-24 04:00:23 UTC
From:
To:
That seems a surprising line to segfault on as there's no dereference
happening.  Maybe optimisation has lead to misleading debug line numbers
though.

"Red Hat Bugzilla – Bug Access Denied"

There's no active upstream for antiword so someone needs to come up with
a patch.  If someone already has that'd be helpful (and better for the
various Linux distros to all use the same fix than each come up with
their own).

Cheers,
    Olly
#1008092#15
Date:
2022-07-08 20:58:42 UTC
From:
To:
Control: tag -1 +moreinfo
Control: severity -1 normal

I still can't access this bug report.

I assume that's where `vAnalyseSummaryInfo.poc.doc` can be found (you
didn't attach it to this bug report), so all I have to go on is the
backtrace which points to a line where there's no dereference.

There aren't any patches in Fedora that we don't have an equivalent of,
except for antiword-0.32-fix-flags.patch which isn't relevant to us:

https://src.fedoraproject.org/rpms/antiword/tree/rawhide

There doesn't seem to be a CVE for this (only ones from 2005 and 2014):

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=antiword

So as it stands, I don't see I can do anything useful with your report.

This is also very much still true.

Tagging appropriately.  I've lowered the severity since failing to
process a single example file is not "a bug which has a major effect on
the usability of a package, without rendering it completely unusable to
everyone".

As best I can make out this is a segfault while reading, so there
doesn't seem there's a security implication either.

Cheers,
    Olly
#1008092#24
Date:
2023-10-09 21:57:46 UTC
From:
To:
As requested here's a summary of one potential unsanitised input data
issue that may be leading to this (or other) error(s).

`vSetSummaryInfoOLE()` calls `pucAnalyseSummaryInfoHeader()` that does:

`if (!bReadBuffer(pFile, ... aucBuffer, ...) ... return aucBuffer;`

and then calls `vAnalyseSummaryInfo(pucBuffer)`

- there-in if `ulOffset` is especially large the following:

`tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);`

could be outside of `aucBuffer` since the size of the buffer is not
passed to this function and therefore cannot be checked.
#1008092#29
Date:
2023-10-09 23:12:49 UTC
From:
To:
A package search on the RedHat bugzilla shows other reports including
tracking bugs for the referenced (security) bug #2064638.

https://bugzilla.redhat.com/buglist.cgi?component=antiword&product=Fedora

It might be worth contacting Adrian Reber for info on this.
#1008092#34
Date:
2023-10-10 04:35:15 UTC
From:
To:
Thanks.

It looks like it needs to return tLength along with aucBuffer and
check accesses against that.  I'll take a look at doing that.

It'd still be helpful to have the "vAnalyseSummaryInfo.poc.doc" file
to reproduce the reported crash as without that we can't test any
fix actually addresses the bug reported here.

I've cc-ed the reporter - hopefully they'll see it this time and
provide that file.

Cheers,
    Olly
#1008092#39
Date:
2023-10-10 04:18:28 UTC
From:
To:
Doesn't seem promising - there's no useful public info there, but
https://bugzilla.redhat.com/show_bug.cgi?id=2064735 says:

| This CVE Bugzilla entry is for community support informational
| purposes only as it does not affect a package in a commercially
| supported Red Hat product. Refer to the dependent bugs for status of
| those individual community products.

Reads to me like "this doesn't affect RHEL so we aren't interested".
The public bugs at least seem to have just been closed without a fix
being applied.

If you think it'll help please do.

Cheers,
    Olly
#1008092#46
Date:
2026-08-24 22:41:50 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
antiword, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1008092@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Olly Betts <olly@survex.com> (supplier of updated antiword package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 25 Aug 2026 10:19:55 +1200
Source: antiword
Architecture: source
Version: 0.37-18
Distribution: unstable
Urgency: medium
Maintainer: Olly Betts <olly@survex.com>
Changed-By: Olly Betts <olly@survex.com>
Closes: 1008092 1131544 1144640 1144641 1144642 1144643 1144645
Changes:
 antiword (0.37-18) unstable; urgency=medium
 .
   * debian/patches/fix-write-after-end-of-font-table.patch: Fix write one past
     end of font table array. (Closes: #1144643)
   * debian/patches/check_fonttable_bounds.patch: Add missing checks for
     running off the end of the fonttable. (Closes: #1144645)
   * debian/patches/fix-divide-by-zero.patch: Avoid integer divide by zero.
     (Closes: #1144640)
   * debian/patches/fix-oob-read-properties.patch: Fix OOB read reading
     document properties (Closes: #1008092, #1144641, #1144642)
   * debian/control: Mark conformance with policy 4.7.4.
   * debian/control: Add `Vcs-Browser:` and `Vcs-git:`. (Closes: #1131544)
   * debian/control: Drop `Rules-Requires-Root: no` which is now the default.
Checksums-Sha1:
 3115426d70a1abd34d959e4731ef06ba397119fe 1790 antiword_0.37-18.dsc
 c05e763f53f2d046b96fb7f68491ef1746f1f5ff 11160 antiword_0.37-18.debian.tar.xz
 1db8668d127da71cc6ed623195dd0b174a09f263 5945 antiword_0.37-18_amd64.buildinfo
Checksums-Sha256:
 7d13c2b780d8686b516a2084bcbae759ea8c1ac898e20bb41d3af8d6263c43dd 1790 antiword_0.37-18.dsc
 1f4ea3e79742584114d9d03d7457d8945b790f4bfec5abc09b4b02c13861c933 11160 antiword_0.37-18.debian.tar.xz
 2ed6e4314dd9dc066724478f1b24aa713f44be588b06a1f7d665d31a8e1ebe13 5945 antiword_0.37-18_amd64.buildinfo
Files:
 34480481ff0a4a8bb2d6343dd5e04bfc 1790 text optional antiword_0.37-18.dsc
 5d1d2a1e64258a046c4a1daaae2f5aed 11160 text optional antiword_0.37-18.debian.tar.xz
 51167f38ea2cfedcf0bd32ea3393a4ef 5945 text optional antiword_0.37-18_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECOJAD/f+j+3jrLUoGBR7BzutKwcFAmqMxKwACgkQGBR7Bzut
KwcjiBAAlP7zrDxSP0PaENSVp7cHH+NflHynN2S+tBEEyUgXzQDa+HNDMnIjMdJq
vPinLw69HGtjPZ3VFxW+xfkmuePmOGQCw4Et797rno6TVVRNw6kTa5MLGN+qu/2E
IqCdS58Ixt23jw/6lUM1f0ZF/3/vQTmoZNTqlnDjg7zsrhX8edkFirhz/njC/gpn
ZYwAo+uertREOGS8ZVThqc054NQUAwxief47GP/ADTZxra2/Gp26+InUbRYcvvv2
+FS3Hsp7xCl0ZlX308yCfLjJQEQw3WTsLPUQj8k8+pgq9cKKeidsOrCQau8Aq8lE
WeF/KTiQgNhyypY3RfT5gwbYszya6RWn+1WZmN47Y/MP9xpcg7VNBBTxriOO9lWA
Xgj8TI+eajTCUdr1iCwQrJuXwmd2fo2IN34EemMRAm8i6fiFnNcvXeQloqDil91G
PvWCPH16pd35pZCqqnaK73lp5LkjOARulv0rhv7OyL50L2LC9UEtBiDxVk/8xsjg
RAQcKTqXblS7J2rXK3iG1modTcEVbWRAZBLdf9h7GfollDN3OTNvIEdDpvaZrGs3
PHPrVvKocAG9ug9JHK49BzXFjhSTyxZZaDlP7urWIVdYymK//en/S4JRLpGTlZhP
+6ZolLUUqCeM6CL/S4jAonUzh/9F7CmZCCGLUca6QmBBKJ1pGgs=
=Q03i
-----END PGP SIGNATURE-----