CVE-2020-21533

An attacker provides a crafted FIG file containing a text object whose data exceeds the size of the stack-allocated buffer 's' (8192 bytes) in read_textobject() [ref_id=1]. When fig2dev processes the file via readfp_fig() -> read_objects() -> read_compoundobject() -> read_textobject(), the oversized input overflows the buffer, as shown by the ASan report at read.c:1378 [ref_id=1]. No authentication or special privileges are required; the victim only needs to open the malicious FIG file with fig2dev.

The vulnerable function is read_textobject() in fig2dev/read.c at line 1378 [ref_id=1]. The stack frame allocates a buffer 's' of 8192 bytes (offset 224 to 8416) and a buffer 's_temp' of 8192 bytes (offset 8448 to 16640) [ref_id=1]. The overflow occurs when reading text object data into 's' without sufficient length validation.

The advisory does not include a patch or describe a specific fix [ref_id=1]. The ticket was closed but no code change is shown. To remediate, the read_textobject() function at read.c:1304-1378 must add bounds checking on the input copied into the stack buffer 's' (size 8192 bytes) to prevent overflow when the text object data exceeds that length [ref_id=1].

Run fig2dev on a crafted FIG file that triggers the overflow in read_textobject() at read.c:1378. The reporter states: "Please run following command to reproduce it" but the exact command and PoC file are not included in the ticket [ref_id=1]. The ASan output confirms the crash occurs at read.c:1378 when processing the malicious input.