Dear Maintainer,

I am reporting on behalf of an engineer at Quarklsab, an out-of-bounds read in antiword 0.37-17 when processing a specially crafted Word document.

This finding is downstream of the separately reported attacker-controlled property offset issue.

In summary.c, szLpstr calculates a string pointer using an offset obtained from the document:

    szStart = (char *)aucBuffer + ulOffset + 8;
    ...
    szResult = xstrdup(szStart);

If the supplied offset places szStart outside the intended buffer, xstrdup subsequently performs strlen/strcpy starting from this invalid location.

The read continues through adjacent heap memory until a NUL byte is encountered. The resulting bytes can then be copied into antiword's output.

Reproduction
============

With the attached PoC document:

    antiword -a a4 ./sample_oob_read_2.doc

Observed behavior:
antiword reads beyond the intended input buffer into adjacent heap memory.

Expected behavior:
The offset and the available string length should be validated before calling xstrdup.

The issue was reproduced with antiword 0.37-17.

I have attached the PoC document and a detailed technical report.

Regards,
Salwa Souaf
Quarkslab VulnReport Team

This doesn't seem like an information disclosure problem though - you're
suggesting this can happen when processing a document file which the
attacker provides, so the attacker knows the content of that file
already.  The contents of Debian's antiword packages is public too
(similarly for any shared library dependencies).

Again, please test with ***DEBIAN*** packages when reporting bugs to
Debian.

This looks like it is the same problem as
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008092 which the
reporter apparently has a reproducer for but never responded when asked
repeatedly to provide it.

I did some work on a patch for that a few months ago - I'll dig it out.

Cheers,
    Olly

I finished off that patch and it fixes this and also #1144641 (your
other OOB read bug).

Cheers,
    Olly