CVE-2018-16140

Vulnerability

The vulnerability resides in the get_line() function in read.c of fig2dev version 3.2.7a. When the length of a line (len) is less than 2, the code attempts to access buf[len-2], which results in a write prior to the beginning of the buffer. This condition is triggered by a specially crafted .fig file. The issue is present in version 3.2.7a and likely earlier versions [1].

Exploitation

An attacker can exploit this by providing a malicious .fig file to fig2dev. No authentication or special privileges are required; the user only needs to run fig2dev on the file. During parsing, get_line() is called, and when len is 1, the check buf[len-2] accesses buf[-1], causing a buffer underwrite. The attacker controls the .fig file content to trigger this condition [1].

Impact

Successful exploitation results in a buffer underwrite, leading to memory corruption. This can cause a denial of service or potentially allow arbitrary code execution, depending on the memory layout. The attacker gains the ability to write before the allocated buffer, which may corrupt adjacent data structures [1].

Mitigation

The recommended fix is to add a check in get_line() similar to the one already applied in read_objects(): ensure len > 1 before accessing buf[len-2]. As of the reference, this fix had not been applied to version 3.2.7a. Users should update to a patched version when available or avoid processing untrusted .fig files [1].