CVE-2020-21531

Vulnerability

In fig2dev version 3.2.7b, the conv_pattern_index function in gencgm.c (line 533) contains a global buffer overflow vulnerability [1]. The function reads from a global array without proper bounds checking, allowing an out-of-bounds read when processing a specially crafted FIG file. The issue is triggered during the conversion of FIG files to CGM format.

Exploitation

An attacker can exploit this vulnerability by providing a malicious FIG file to the fig2dev utility. The user must run fig2dev on the crafted file, which causes the conv_pattern_index function to read beyond the bounds of a global array, as demonstrated by the AddressSanitizer output showing a READ of size 4 at an invalid address [1]. No authentication or special privileges are required beyond the ability to supply the input file.

Impact

Successful exploitation results in a denial of service (DoS) due to the application crash caused by the global buffer overflow. The crash is confirmed by the AddressSanitizer report [1]. The impact is limited to availability; there is no indication of code execution or information disclosure from the available references.

Mitigation

As of the latest available information, no official patch has been released for this vulnerability. The ticket on the project's issue tracker is closed but does not mention a fix [1]. Users should avoid processing untrusted FIG files with fig2dev 3.2.7b until a patched version is available. Upgrading to a newer version of fig2dev may address the issue, but no specific fixed version has been identified.