[GH-ISSUE #323] Fuzzing issues: help needed #261

New issue

Closed

opened 2026-05-05 12:03:18 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 12:03:18 -06:00

Owner

Originally created by @jmcnamara on GitHub (Mar 27, 2021).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/323

Originally assigned to: @jmcnamara on GitHub.

There are 2 fuzzing issues that have been reported:

#312 heap-buffer-overflow in utility.c:461:12
#313 stack-buffer-overflow in worksheet_insert_image_buffer_opt

I've closed the originals to merge them into this single amalgamated issue but you can see the details in the links.

I'm looking for someone to:

Reproduce the issues
Propose a fix for each and, after discussion, implement it.

Originally created by @jmcnamara on GitHub (Mar 27, 2021). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/323 Originally assigned to: @jmcnamara on GitHub. There are 2 fuzzing issues that have been reported: - #312 heap-buffer-overflow in utility.c:461:12 - #313 stack-buffer-overflow in worksheet_insert_image_buffer_opt I've closed the originals to merge them into this single amalgamated issue but you can see the details in the links. I'm looking for someone to: - Reproduce the issues - Propose a fix for each and, after discussion, implement it.

gitea-mirror

2026-05-05 12:03:18 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 12:03:22 -06:00

Author

Owner

@ANaumann85 commented on GitHub (Apr 4, 2021):

I looked at the buffer-overflow in issue #313 . In that example, the user creates a buffer on the heap, but gives the wrong buffer size to the function "worksheet_insert_image_buffer". At that point, you have very small chances to detect that mistake. In my optinion, the issue #313 is not a bug in the library, but a wrong usage.

@ANaumann85 commented on GitHub (Apr 4, 2021): I looked at the buffer-overflow in issue #313 . In that example, the user creates a buffer on the heap, but gives the wrong buffer size to the function "worksheet_insert_image_buffer". At that point, you have very small chances to detect that mistake. In my optinion, the issue #313 is not a bug in the library, but a wrong usage.

gitea-mirror commented

2026-05-05 12:03:23 -06:00

Author

Owner

@ANaumann85 commented on GitHub (Apr 4, 2021):

The issue #312 is a bit delicate and consists of two problems:

It seems, that you rely on the null terminator of a string. For example in the file worksheet.c is a check for the end of the string using !*string. That works only, if your string is really terminated by a 0. But if you get a zero-length array without the null-terminator, then the test does not work.
the function lxw_utf8_strlen also relies on the zero-terminated string. If your string is not zero-terminated, the loop will not stop at the end of the string, but some where else.

Both problems arise, if you got wrongly terminated strings. It is not clear to me, how one should handle these errors. In my opinion, these are user errors.

@ANaumann85 commented on GitHub (Apr 4, 2021): The issue #312 is a bit delicate and consists of two problems: 1. It seems, that you rely on the null terminator of a string. For example in the [file worksheet.c](https://github.com/jmcnamara/libxlsxwriter/blob/9aa3d73a5bd1f18d6777f01d4652ca19940cd0e0/src/worksheet.c#L6673) is a check for the end of the string using `!*string`. That works only, if your string is really terminated by a 0. But if you get a zero-length array without the null-terminator, then the test does not work. 2. the function `lxw_utf8_strlen` also relies on the zero-terminated string. If your string is not zero-terminated, [the loop](https://github.com/jmcnamara/libxlsxwriter/blob/9aa3d73a5bd1f18d6777f01d4652ca19940cd0e0/src/utility.c#L461) will not stop at the end of the string, but some where else. Both problems arise, if you got wrongly terminated strings. It is not clear to me, how one should handle these errors. In my opinion, these are user errors.

gitea-mirror commented

2026-05-05 12:03:25 -06:00

Author

Owner

@jmcnamara commented on GitHub (Apr 5, 2021):

@ANaumann85 Thank you, I appreciate your analysis. Could you also add those comments to the issues (even if they are marked as closed). Thanks once more.

@jmcnamara commented on GitHub (Apr 5, 2021): @ANaumann85 Thank you, I appreciate your analysis. Could you also add those comments to the issues (even if they are marked as closed). Thanks once more.

gitea-mirror commented

2026-05-05 12:03:26 -06:00

Author

Owner

@jmcnamara commented on GitHub (Apr 7, 2021):

Closing this merged issue. Any further discussion should happen in the individual bug reports.

@jmcnamara commented on GitHub (Apr 7, 2021): Closing this merged issue. Any further discussion should happen in the individual bug reports.

gitea-mirror referenced this issue

2026-05-05 12:16:15 -06:00

[PR #261] [CLOSED] Rename MD5 function for openssl static linking #452