Dear Maintainer,
I am reporting on behalf of an engineer at Quarkslab, a heap out-of-bounds write in antiword 0.37-17 when processing a malformed font-family name from a Word document.
The issue occurs in unincpy in misc.c.
unincpy copies n translated characters into its destination while reading two bytes from the source for every iteration:
for (pcDest = s1, tLen = 0; tLen < n; pcDest++, tLen++) {
usUni = usGetWord(tLen * 2, s2);
...
*pcDest = (char)ulChar;
}
In the vulnerable path, the source is the document-controlled aucFont font-name data and the destination is the fixed-size szWordFontname field.
There is no validation that the source contains 2*n bytes or that the destination has capacity for n output bytes.
A malformed font-family name can therefore cause both an out-of-bounds read of the source and writes past the destination font-name buffer.
CWE: CWE-787 (Out-of-bounds Write)
CWE-120 (Buffer Copy without Checking Size of Input)
Security impact
===============
The destination overflow corrupts adjacent heap memory. Our analysis indicates that the resulting heap corruption could potentially be used toward code execution with appropriate heap layout/grooming. Reliable arbitrary code execution has not been demonstrated.
Reproduction
============
With the attached PoC document:
antiword -a a4 ./sample_oob_write_2.doc
Expected behavior:
antiword should validate both the source length and destination capacity before performing the conversion.
The issue was reproduced with antiword 0.37-17.
I have attached the PoC document and a detailed technical report.
Regards,
Salwa Souaf
Quarkslab VulnReport Team
This seems to be the case.
However this doesn't seem to be true to me. You don't explicitly give
the source location, but the only call which fits is this one in fonts.c:
(void)unincpy(pFontTableRecord->szWordFontname,
aucFont,
sizeof(pFontTableRecord->szWordFontname) - 1);
The value passed for n is one less than the size of the fixed szWordFontname
field.
I think you've misunderstood what's happening here. The problem actually seems
to be that pFontTableRecord is past the end of pFontTable. If I apply this
patch then antiword exists with "XXX":
--- a/fonts.c
+++ b/fonts.c
@@ -865,6 +865,9 @@ vCreate8FontTable(FILE *pFile, const pps_info_type *pPPS,
NO_DBG_UNICODE(aucFont);
NO_DBG_UNICODE(aucAltFont);
}
+ if (pTmp - pFontTable >= tFontTableRecords) {
+ werr(1, "XXX\n");
+ }
vFontname2Table(aucFont, aucAltFont, 2, iEmphasis,
ucFFN, szWordFont, szOurFont, pTmp);
pTmp += 4;
[...]
When reporting a bug to Debian please test using Debian's packages not those of
a derived distribution.
Cheers,
Olly
Control: tag 1144645 + pending
Control: clone 1144645 -1
Control: retitle -1 antiword: heap out-of-bounds read during Unicode font-name conversion
Control: severity -1 normal
I have a fix for this (and two similar cases for the font table handling
for other versions of the file format).
The OOB read is not really the same problem so I've split that into a
new bug.
Cheers,
Olly
We believe that the bug you reported is fixed in the latest version of
antiword, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1144645@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Olly Betts <olly@survex.com> (supplier of updated antiword package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 25 Aug 2026 10:19:55 +1200
Source: antiword
Architecture: source
Version: 0.37-18
Distribution: unstable
Urgency: medium
Maintainer: Olly Betts <olly@survex.com>
Changed-By: Olly Betts <olly@survex.com>
Closes: 1008092 1131544 1144640 1144641 1144642 1144643 1144645
Changes:
antiword (0.37-18) unstable; urgency=medium
.
* debian/patches/fix-write-after-end-of-font-table.patch: Fix write one past
end of font table array. (Closes: #1144643)
* debian/patches/check_fonttable_bounds.patch: Add missing checks for
running off the end of the fonttable. (Closes: #1144645)
* debian/patches/fix-divide-by-zero.patch: Avoid integer divide by zero.
(Closes: #1144640)
* debian/patches/fix-oob-read-properties.patch: Fix OOB read reading
document properties (Closes: #1008092, #1144641, #1144642)
* debian/control: Mark conformance with policy 4.7.4.
* debian/control: Add `Vcs-Browser:` and `Vcs-git:`. (Closes: #1131544)
* debian/control: Drop `Rules-Requires-Root: no` which is now the default.
Checksums-Sha1:
3115426d70a1abd34d959e4731ef06ba397119fe 1790 antiword_0.37-18.dsc
c05e763f53f2d046b96fb7f68491ef1746f1f5ff 11160 antiword_0.37-18.debian.tar.xz
1db8668d127da71cc6ed623195dd0b174a09f263 5945 antiword_0.37-18_amd64.buildinfo
Checksums-Sha256:
7d13c2b780d8686b516a2084bcbae759ea8c1ac898e20bb41d3af8d6263c43dd 1790 antiword_0.37-18.dsc
1f4ea3e79742584114d9d03d7457d8945b790f4bfec5abc09b4b02c13861c933 11160 antiword_0.37-18.debian.tar.xz
2ed6e4314dd9dc066724478f1b24aa713f44be588b06a1f7d665d31a8e1ebe13 5945 antiword_0.37-18_amd64.buildinfo
Files:
34480481ff0a4a8bb2d6343dd5e04bfc 1790 text optional antiword_0.37-18.dsc
5d1d2a1e64258a046c4a1daaae2f5aed 11160 text optional antiword_0.37-18.debian.tar.xz
51167f38ea2cfedcf0bd32ea3393a4ef 5945 text optional antiword_0.37-18_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEECOJAD/f+j+3jrLUoGBR7BzutKwcFAmqMxKwACgkQGBR7Bzut
KwcjiBAAlP7zrDxSP0PaENSVp7cHH+NflHynN2S+tBEEyUgXzQDa+HNDMnIjMdJq
vPinLw69HGtjPZ3VFxW+xfkmuePmOGQCw4Et797rno6TVVRNw6kTa5MLGN+qu/2E
IqCdS58Ixt23jw/6lUM1f0ZF/3/vQTmoZNTqlnDjg7zsrhX8edkFirhz/njC/gpn
ZYwAo+uertREOGS8ZVThqc054NQUAwxief47GP/ADTZxra2/Gp26+InUbRYcvvv2
+FS3Hsp7xCl0ZlX308yCfLjJQEQw3WTsLPUQj8k8+pgq9cKKeidsOrCQau8Aq8lE
WeF/KTiQgNhyypY3RfT5gwbYszya6RWn+1WZmN47Y/MP9xpcg7VNBBTxriOO9lWA
Xgj8TI+eajTCUdr1iCwQrJuXwmd2fo2IN34EemMRAm8i6fiFnNcvXeQloqDil91G
PvWCPH16pd35pZCqqnaK73lp5LkjOARulv0rhv7OyL50L2LC9UEtBiDxVk/8xsjg
RAQcKTqXblS7J2rXK3iG1modTcEVbWRAZBLdf9h7GfollDN3OTNvIEdDpvaZrGs3
PHPrVvKocAG9ug9JHK49BzXFjhSTyxZZaDlP7urWIVdYymK//en/S4JRLpGTlZhP
+6ZolLUUqCeM6CL/S4jAonUzh/9F7CmZCCGLUca6QmBBKJ1pGgs=
=Q03i
-----END PGP SIGNATURE-----