Dear Maintainer,

I am reporting on behalf of an engineer at Quarklsab, a heap out-of-bounds write in antiword 0.37-17 which can be triggered by a specially crafted Word document.

The issue occurs in fonts.c when antiword determines that an additional table font has to be appended.

pTmp is set to the element immediately following the allocated font table and is then written to without checking that additional capacity is available:

    if (bMustAddTableFont) {
        pTmp = pFontTable + tFontTableRecords;
        fail(pTmp <= pFontTable);

        pTmp->ucWordFontNumber =
            (pTmp - 1)->ucWordFontNumber + 1;

        pTmp->usFontStyle = FONT_REGULAR;
        strcpy(pTmp->szWordFontname, "Extra Table Font");
    }

The allocation is sized for tFontTableRecords elements, meaning pTmp points one element past the allocated font table.

This results in writes into the heap chunk adjacent to the font table.
The written data is partially influenced by document-controlled state.

CWE: CWE-787 (Out-of-bounds Write)
             CWE-193 (Off-by-one Error)

Security impact
===============

The finding provides a heap-corruption primitive. Our analysis indicates that it may potentially be usable toward code execution with suitable heap layout/grooming. Reliable arbitrary code execution has not been demonstrated.

Reproduction
============

With the attached PoC document:

    antiword -a a4 ./sample_oob_write_1.doc

Expected behavior:
antiword should ensure sufficient capacity before adding an additional font-table entry.

The issue was reproduced with antiword 0.37-17.

I have attached the PoC document and a detailed technical report.

Regards,
Salwa Souaf    
Quarkslab VulnReport Team