Dear Maintainer,


I am reporting on behalf of an engineer at Quarklsab, an out-of-bounds read in antiword 0.37-17 when processing a specially crafted Word document.

The issue occurs while parsing property-set records in summary.c. Both the record count and the property offset are obtained directly from the input buffer, and the offset is subsequently dereferenced without a range check:

    tCount = (size_t)ulGetLong(4, aucBuffer);

    for (tIndex = 0; tIndex < tCount; tIndex++) {
        tPropID   = (size_t)ulGetLong(8 + tIndex * 8, aucBuffer);
        ulOffset  = ulGetLong(12 + tIndex * 8, aucBuffer);
        tPropType = (size_t)ulGetLong(ulOffset, aucBuffer);
        ...
        szTitle = szLpstr(ulOffset, aucBuffer);
    }

The attacker therefore controls a 32-bit offset which is dereferenced relative to the property buffer without validating that it lies inside the buffer.

Depending on the supplied offset this results in an invalid read and a crash. For offsets which reference readable memory outside the intended property data, bytes can also flow into program output through szLpstr.

CWE: CWE-125 (Out-of-bounds Read)
             CWE-822 (Untrusted Pointer Dereference)

Reproduction
============

With the attached PoC document:

    antiword -a a4 ./sample_oob_read_1.doc

Observed behavior:
antiword performs an out-of-bounds read and may crash.

Expected behavior:
Property offsets supplied by the document should be range-checked before they are dereferenced.

The issue was reproduced with antiword 0.37-17.

I have attached the PoC document and a detailed technical report.

Regards,
Salwa Souaf    
Quarkslab VulnReport Team