VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 16, 2021· Updated Aug 4, 2024

CVE-2020-21534

CVE-2020-21534

Description

A global buffer overflow in fig2dev 3.2.7b's get_line function can be triggered via a crafted FIG file, leading to memory corruption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A global buffer overflow in fig2dev 3.2.7b's get_line function can be triggered via a crafted FIG file, leading to memory corruption.

Vulnerability

A global buffer overflow vulnerability exists in fig2dev version 3.2.7b in the get_line function within read.c at line 1528. The bug is triggered when processing a specially crafted FIG file, causing a read of size 1 at a location 59 bytes to the right of the global variable gif_colnum. The affected code path is reachable through read_objects, readfp_fig, read_fig, and ultimately main [1].

Exploitation

An attacker can exploit this vulnerability by providing a malformed FIG file to fig2dev. No special privileges or network access is required beyond the ability to supply the file. The attacker needs to craft a FIG file that causes get_line to read beyond the bounds of the global buffer, as demonstrated by the AddressSanitizer report [1].

Impact

Successful exploitation results in a global buffer overflow, which can lead to memory corruption and potentially a denial of service. The impact is limited to read access past the buffer boundary, but could be leveraged to cause a crash or other undefined behavior [1].

Mitigation

As of the latest references (2021-09-16), no explicit fix or patched version has been released for this vulnerability. The ticket on the project's issue tracker (SourceForge) has been reported but remained open at the time of reference. Users should handle FIG files from untrusted sources with caution and consider using alternative tools or limiting exposure until a patch is available [1].

References
  1. Xfig / Tickets / #58 global-buffer-overflow in get_line() function

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

23

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds checking in the get_line function at read.c:1528 allows reading past the end of a global buffer."

Attack vector

An attacker provides a crafted FIG file that triggers a global-buffer-overflow in the get_line function at read.c:1528 [ref_id=1]. The overflow occurs when the function reads beyond the boundary of the global variable 'gif_colnum' (4 bytes at read.c:80) into adjacent memory, specifically 1 byte to the left of the global 'buf' array (8192 bytes at read.c:81) [ref_id=1]. The bug is reachable through the normal file-processing path: read_fig (read.c:142) calls readfp_fig (read.c:172), which calls read_objects (read.c:278), which invokes get_line [ref_id=1]. No authentication or special privileges are required beyond the ability to supply a malicious FIG file to fig2dev.

Affected code

The global-buffer-overflow occurs in the get_line function at read.c:1528 [ref_id=1]. The call chain is: main (fig2dev.c:422) → read_fig (read.c:142) → readfp_fig (read.c:172) → read_objects (read.c:278) → get_line (read.c:1528) [ref_id=1]. The adjacent global variables involved are 'gif_colnum' (defined at read.c:80, size 4 bytes) and 'buf' (defined at read.c:81, size 8192 bytes) [ref_id=1].

What the fix does

No patch is included in the bundle. The advisory [ref_id=1] reports the bug in fig2dev 3.2.7b and confirms it is reproducible in the git master branch, but does not provide a fix or remediation guidance. The ticket was closed without an attached patch, so no official fix is documented in the available materials.

Preconditions

  • inputAttacker must supply a crafted FIG file that triggers the overflow in get_line.

Reproduction

The advisory [ref_id=1] states: "Please run following command to reproduce it" but the command itself is not included in the ticket body. The ASan output shows the crash occurs when processing a FIG file through fig2dev. No explicit reproduction steps or PoC file are provided in the bundle.

Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.