Opened 4 years ago

Closed 4 years ago

#14243 closed enhancement (fixed)

Create security patch for raptor2 (CVE-2017-18926)

Reported by: Douglas R. Reno Owned by: Douglas R. Reno
Priority: high Milestone: 10.1
Component: BOOK Version: SVN
Severity: normal Keywords:


This morning, Hanno Bock posted on oss-security:

3 years ago I reported a heap overflow vulnerability in raptor, an RDF
parsing library:

raptor has not created a new release since 2014.

The most prominent user seems to be libreoffice. This is triggerable
from within an ODT file. Back then I reported this to libreoffice as
well and they patched it in their builds. However on linux systems
libreoffice package usually use the system-provided libraptor, so if
that's not patched it is vulnerable.

This was unpatched for a long time in many linux distros, in some it
still is. Debian+Ubuntu have released updates in the past few days.

It may be interesting to discuss how this happened. From my side I feel
I did what I should do - I reported it to the project and later
disclosed it publicly on oss-security. Apparently it seems there is no
reliable process to make sure publicly reported vulns eventually get
patched in distros if there is no active upstream.
Maybe noteworthy is that this didn't get a CVE in 2017. It seems many
distros rely on CVEs to get a process of backporting fixes rolling.
Given the fluctuating reliability of CVE assignments not sure this is
wise. I have now requested a CVE (CVE-2017-18926).

Here is a minimal reproducer embedded in an ODT file:

I get an
malloc(): invalid size (unsorted)
message, which I believe indicates this successfully triggers a heap

FWIW I recently tried to fuzz raptor again with the fix applied. I
quickly found another OOB issue

From the bug report:

A malformed input file can lead to a segfault due to an out of bounds
array access in raptor_xml_writer_start_element_common.

Bug happens in line 230 of raptor_xml_writer.c (current git):

From looking at that code it seems to me it always expects
nspace_declarations_count to be lower than element->attribute_count,
however this input seems to create a different situation. I made an
attempt at a patch that throws an error in this situation (but please
review it, I am not familiar with what this code does and should do -
though the patch doesn't seem to introduce test failures).

(proposed patch, example file and stacktrace can be found attached to
the bugreport)

Note that Raptor has not created a new release since 2014.

The following patches need to be applied:

(In the bug report below)

Change History (2)

comment:1 by Douglas R. Reno, 4 years ago

Owner: changed from blfs-book to Douglas R. Reno
Status: newassigned

comment:2 by Douglas R. Reno, 4 years ago

Resolution: fixed
Status: assignedclosed

Fixed at r23899

Note: See TracTickets for help on using tickets.