Bugzilla Bug 53389

intro:

Aspell was intended as a more accurate and robust
replacement for the popular ispell package, and was
written by GNU.  Aspell includes a small utility for
compressing and decompressing wordlists before
processing by aspell, namely 'word-list-compress'.

Due to insufficient bounds checking, a malformed
wordlist can cause for a stack based buffer overflow
to occur, possibly allowing execution of arbitrary
code with the privileges of the invoking user.

demo:


[root@leela](~) # echo `perl -e 'print "a"x1000'` | word-list-compress c
Segmentation fault
[root@leela](~) # echo `perl -e 'print "a"x1000'` | word-list-compress d
t

intro:

Aspell was intended as a more accurate and robust
replacement for the popular ispell package, and was
written by GNU.  Aspell includes a small utility for
compressing and decompressing wordlists before
processing by aspell, namely 'word-list-compress'.

Due to insufficient bounds checking, a malformed
wordlist can cause for a stack based buffer overflow
to occur, possibly allowing execution of arbitrary
code with the privileges of the invoking user.

demo:


[root@leela](~) # echo `perl -e 'print "a"x1000'` | word-list-compress c
Segmentation fault
[root@leela](~) # echo `perl -e 'print "a"x1000'` | word-list-compress d
t·®Â½
t·®Â½
Segmentation fault

--patch--

--- aspell-bug.patch ---
--- compress.orig.c        2004-06-08 16:37:00.000000000
+0100
+++ compress.c        2004-06-08 16:34:35.000000000 +0100
@@ -28,6 +28,9 @@
 
 #endif
 
+int count; 
+
+
 void usage () 
 {
   fputs("Compresses or uncompresses sorted word
lists.\n"     , stderr);
@@ -47,6 +50,7 @@
     *w++ = (char)(c);
   } while (c = getc(in), c != EOF && c > 32);
   *w = '\0';
+  count++;
   ungetc(c, in);
   if (c == EOF) return 0;
   else return 1;
@@ -69,6 +73,7 @@
 
     SETBIN (stdout);
 
+    while(count < 256) {
     while (get_word(stdin, cur)) {
       int i = 0;
       /* get the length of the prefix */
@@ -85,6 +90,7 @@
         prev = s2; cur = s1;
       }
     }
+    }
     return 0;
 
   } else if (argv[1][0] == 'd') {
@@ -100,8 +106,11 @@
       if (i == 0)
         i = getc(stdin);
       --i;  
-      while ((c = getc(stdin)) > 32)
+      while ((c = getc(stdin)) > 32 && count < 256) {

         cur[i++] = (char)c;
+        count++;
+    }
+      
       cur[i] = '\0';
       fputs(cur, stdout);
       putc('\n', stdout);
--- EOF ---

...found in bugtraq...

best regards

florian



Reproducible: Always
Steps to Reproduce:
1.
2.
3.

thanks Florian, I'll check this out then check it in.

florian, securityfocus seems to have removed this.  can you verify the URL to
the advisory please?

hi seemant,
the original advisory can be found at:

http://nettwerked.mg2.org/advisories/wlc

Best Regards,
Florian

ok, aspell-0.50.5-r1 is in portage and stable on x86 and s390.  Awaiting EVERY
other arch to stabilise.

Since you asked so nicely... sparc mips

Marked ppc

Stable on hppa.

Stable on alpha.

Stable on all required arches, we can issue a GLSA.

GLSA drafted: security please review.

It seems this patch breaks the word-list-compress binary in
app-text/aspell-0.50.5-r1.  See Bug 53801 for more details.  Here is a new
patch that passes the tests posted here as well as restores the previous
functionality.

30a31,32
> #define WORD_BUFF_SIZE 256
>
43a46
>   int count = 0;
48c51,52
<   } while (c = getc(in), c != EOF && c > 32);
---
>     count++;
>   } while (c = getc(in), c != EOF && c > 32 && count < (WORD_BUFF_SIZE - 1));
64,65c68,69
<     char s1[256];
<     char s2[256];
---
>     char s1[WORD_BUFF_SIZE];
>     char s2[WORD_BUFF_SIZE];
92c96
<     char cur[256];
---
>     char cur[WORD_BUFF_SIZE];
103c107
<       while ((c = getc(stdin)) > 32)
---
>       while ((c = getc(stdin)) > 32 && i < (WORD_BUFF_SIZE - 1)) {
104a109
>       }

Bug 53801 blocks this fix. Going back to [ebuild] status while investigating.

Ready for the GLSA now...

GLSA 200406-14

Arch maintainers please test and stabilize aspell-0.50.5-r4.ebuild

The previous security patch included in gentoo for aspell was apparently
incorrect. It counted the words rather than characters. This revision fixes
that. This was brought to our attention by by Ludwig Nussel
<ludwig.nussel@suse.de>

http://savannah.gnu.org/cgi-bin/viewcvs/aspell/aspell/prog/compress.c.diff?r1=1.2.2.3&r2=1.2.2.1

alpha, amd64, ia64 and x86 done

stable on ppc

sparc happy.

Stable on mips

As i said, it's sparc happy, so s390@ goes back and sparc@ goes out of the cc,
thanks hardave for the headsup!

GLSA 200406-14 updated.

Klieber will you issue an errata?

Stable on hppa.

arm stable

GLSA 200406-14 reissued

s390 stable