#1008146 aha: Buffer overflow in main function at aha.c:973 in aha 0.5.1

Package:
aha
Source:
aha
Description:
ANSI color to HTML converter
Submitter:
"Jieyong Ma @ tdhxkj.com"
Date:
2022-04-28 20:48:03 UTC
Severity:
important
Tags:
#1008146#5
Date:
2022-03-23 09:21:39 UTC
From:
To:
Dear Maintainer,

aha: Buffer overflow in main function at aha.c:973 in aha 0.5.1 allows remote attackers to cause a denial of service (crash) via a crafted input document.

==Version:==
root@max:/home/fuzz/poc/aha# apt-cache policy antiword
antiword:
  Installed: 0.37-16
  Candidate: 0.37-16
  Version table:
 *** 0.37-16 500
        500 http://mirrors.ustc.edu.cn/debian bullseye/main amd64 Packages
        100 /var/lib/dpkg/status

==Crash:==
root@max:/home/fuzz/poc/aha# aha -f poc.txt
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!-- This file was created with the aha Ansi HTML Adapter. https://github.com/theZiz/aha -->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="application/xml+xhtml; charset=UTF-8"/>
<title>poc.txt</title>
</head>
<body>
<pre>
Segmentation fault

==Backtraces:==
root@fuzz06:/home/fuzz/fuzz/aha-master# gdb --args ./aha -f out/fuzzer1/crashes/poc.txt
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.1) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./aha...
(gdb) r
Starting program: /home/fuzz/fuzz/aha-master/aha -f out/fuzzer1/crashes/poc.txt
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!-- This file was created with the aha Ansi HTML Adapter. https://github.com/theZiz/aha -->
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="application/xml+xhtml; charset=UTF-8"/>
<title>out/fuzzer1/crashes/poc.txt</title>
</head>
<body>
<pre>

Program received signal SIGSEGV, Segmentation fault.
0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
973								momelem=momelem->next;
(gdb) bt
#0  0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
(gdb) l
968											state.highlighted = 1;
969											*dest=momelem->value-100;
970										}
971										break;
972								}
973								momelem=momelem->next;
974							}
975							deleteParse(elem);
976						break;
977						case 'H':
(gdb) n

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

Ref:https://github.com/theZiz/aha/issues/95
#1008146#10
Date:
2022-03-23 09:33:29 UTC
From:
To:
Sorry to provide wrong information at the "Version" section.
It should be:

root@max:/home/fuzz/poc/aha# apt-cache policy aha
aha:
  Installed: 0.5.1-1
  Candidate: 0.5.1-1
  Version table:
 *** 0.5.1-1 500
        500 http://mirrors.ustc.edu.cn/debian bullseye/main amd64 Packages
        100 /var/lib/dpkg/status