VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 16, 2021· Updated Aug 4, 2024

CVE-2020-21529

CVE-2020-21529

Description

A stack overflow in fig2dev 3.2.7b's bezier_spline function allows denial of service via crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stack overflow in fig2dev 3.2.7b's bezier_spline function allows denial of service via crafted input.

Vulnerability

A stack overflow vulnerability exists in fig2dev version 3.2.7b within the bezier_spline function in genepic.c at line 1168. The bug is triggered by recursive calls that exhaust the stack, as demonstrated by AddressSanitizer output showing repeated invocations of bezier_spline [1]. The affected version is fig2dev 3.2.7b.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted input file (e.g., a .fig file) that causes the bezier_spline function to recurse deeply. No authentication or special privileges are required; the victim simply needs to process the malicious file using fig2dev. The exact sequence involves running fig2dev with the crafted file as input, leading to the stack overflow [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a stack overflow, causing the application to crash. There is no indication of code execution or information disclosure in the available reference [1]. The impact is limited to availability.

Mitigation

The reference ticket [1] does not specify a fixed version or release date. Users should monitor the fig2dev project for updates and apply any patches that address this issue. As of the publication date (2021-09-16), no official fix has been disclosed in the available references.

References
  1. Xfig / Tickets / #65 stack-overflow in bezier_spline function

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

24

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Unbounded recursion in the bezier_spline function at genepic.c:1168 causes a stack overflow when processing crafted input."

Attack vector

An attacker provides a specially crafted FIG file that causes the bezier_spline function in genepic.c to recursively call itself without a termination condition. The ASAN trace shows hundreds of recursive calls to the same function at the same source line [ref_id=1], eventually exhausting the call stack. The vulnerability is triggered when fig2dev processes the malicious FIG file during conversion.

Affected code

The vulnerability is in the bezier_spline function in fig2dev-3.2.7b/fig2dev/dev/genepic.c at line 1168 [ref_id=1].

What the fix does

No patch is included in the bundle. The advisory [ref_id=1] reports the stack-overflow in bezier_spline at genepic.c:1168 in fig2dev 3.2.7b but does not provide a fix. Remediation would require adding a recursion depth limit or converting the recursive algorithm to an iterative one to prevent stack exhaustion.

Preconditions

  • inputThe attacker must supply a crafted FIG file that triggers unbounded recursion in bezier_spline.
  • configThe victim must run fig2dev to convert the malicious FIG file.

Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.