Headline
CVE-2023-48107: Heap-buffer-overflow in mz_os.c:71 mz_path_has_slash · Issue #739 · zlib-ng/minizip-ng
Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function in the mz_os.c file.
poc0 is a malformed zip file generated by fuzzer. I used the "-x" flag when testing and it came into a heap-buffer-overflow crash. So maybe you could give a proper prompt when using "-x" to extract malformed files like poc0?
Aaaah, ok.
When built without ASAN the poc0 zipfile triggers an error when you attempt to extract it
$ ./minizip -x poc0
minizip-ng 4.0.2 - https://github.com/zlib-ng/minizip-ng
---------------------------------------------------
-x poc0
Archive poc0
Extracting .\
Error -104 saving entries to disk poc0
That said, there is still a buffer overflow present. Let’s take a look at that
FYI - the cmake build now support building with ASAN, like this.
cmake -S . -B build -D MZ_BUILD_TESTS=ON -DMZ_SANITIZER=Address
When I run that I get the line numbers where the problems are
./minizip -x poc0
minizip-ng 4.0.2 - https://github.com/zlib-ng/minizip-ng
---------------------------------------------------
-x poc0
Archive poc0
Extracting .\
=================================================================
==49164==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000010f at pc 0x55686d69e58d bp 0x7ffc7a5e2d80 sp 0x7ffc7a5e2d70
READ of size 1 at 0x60200000010f thread T0
#0 0x55686d69e58c in mz_path_has_slash /home/paul/git/minizip-ng/mz_os.c:71
#1 0x55686d6b55e1 in mz_zip_reader_entry_save_file /home/paul/git/minizip-ng/mz_zip_rw.c:698
#2 0x55686d6b67ef in mz_zip_reader_save_all /home/paul/git/minizip-ng/mz_zip_rw.c:893
#3 0x55686d69c6f0 in minizip_extract /home/paul/git/minizip-ng/minizip.c:379
#4 0x55686d69e02c in main /home/paul/git/minizip-ng/minizip.c:654
#5 0x7f2f44c280cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#6 0x7f2f44c28188 in __libc_start_main_impl ../csu/libc-start.c:360
#7 0x55686d69a264 in _start (/home/paul/git/minizip-ng/build/minizip+0x7264) (BuildId: 576262a7c293cbb21845b25bd97a13cb33d9dd27)
0x60200000010f is located 1 bytes before 1-byte region [0x602000000110,0x602000000111)
allocated by thread T0 here:
#0 0x7f2f456de997 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77
#1 0x55686d6b5269 in mz_zip_reader_entry_save_file /home/paul/git/minizip-ng/mz_zip_rw.c:665
#2 0x55686d6b67ef in mz_zip_reader_save_all /home/paul/git/minizip-ng/mz_zip_rw.c:893
#3 0x55686d69c6f0 in minizip_extract /home/paul/git/minizip-ng/minizip.c:379
#4 0x55686d69e02c in main /home/paul/git/minizip-ng/minizip.c:654
#5 0x7f2f44c280cf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/paul/git/minizip-ng/mz_os.c:71 in mz_path_has_slash
Shadow bytes around the buggy address:
0x601ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x601fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x601fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x602000000000: fa fa 05 fa fa fa 00 06 fa fa fd fd fa fa fd fd
0x602000000080: fa fa 00 07 fa fa 00 01 fa fa 00 01 fa fa 00 01
=>0x602000000100: fa[fa]01 fa fa fa 01 fa fa fa fa fa fa fa fa fa
0x602000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x602000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x602000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x602000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x602000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==49164==ABORTING
Memory allocation in the pathwfs in mz_zip_reader_entry_save_file
int32_t mz_zip_reader_entry_save_file(void *handle, const char *path) {
mz_zip_reader *reader = (mz_zip_reader *)handle;
void *stream = NULL;
uint32_t target_attrib = 0;
int32_t err_attrib = 0;
int32_t err = MZ_OK;
int32_t err_cb = MZ_OK;
size_t path_length = 0;
char *pathwfs = NULL;
char *directory = NULL;
if (mz_zip_reader_is_open(reader) != MZ_OK)
return MZ_PARAM_ERROR;
if (!reader->file_info || !path)
return MZ_PARAM_ERROR;
path_length = strlen(path);
/* Convert to forward slashes for unix which doesn't like backslashes */
pathwfs = (char *)calloc(path_length + 1, sizeof(char));
The error is triggered in the if statement below
int32_t mz_path_has_slash(const char *path) {
int32_t path_len = (int32_t)strlen(path);
if (path[path_len - 1] != '\\' && path[path_len - 1] != '/')
return MZ_EXIST_ERROR;
return MZ_OK;
}
This needs further analysis