[GH-ISSUE #487] Global Buffer Overflow in `format_set_pattern()` Function #381

New issue

Closed

opened 2026-05-05 12:13:50 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 12:13:50 -06:00

Owner

Originally created by @LkkkLxy on GitHub (Sep 30, 2025).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/487

Summary

A global buffer overflow vulnerability exists in the libxlsxwriter library when using format_set_pattern() with invalid pattern values. This can lead to memory corruption and program crashes.

Environment

Library Version: Latest (as of analysis)
Platform: Linux x86_64
Compiler: clang with AddressSanitizer
Detection Tool: AddressSanitizer

Vulnerability Details

Type: Global buffer overflow
Location: _write_fill() function in /src/libxlsxwriter/src/styles.c:732
Affected Function: format_set_pattern()

Root Cause

The format_set_pattern() function accepts pattern values without proper bounds checking. When an invalid pattern value (e.g., 19) is used, it causes an out-of-bounds access in the _write_fill() function during workbook serialization. The patterns array in _write_fill() has a fixed size that doesn't accommodate all possible pattern values.

Steps to Reproduce

Compile the following test program with AddressSanitizer:

clang test.c -o test -fsanitize=address -I<libxlsxwriter_include_path> -lxlsxwriter -lz

Run the test program:

#include <xlsxwriter.h>
#include <stdio.h>

int main() {
    // Create workbook
    lxw_workbook *workbook = workbook_new("test.xlsx");
    if (!workbook) return 1;

    // Add worksheet
    lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL);
    if (!worksheet) {
        workbook_close(workbook);
        return 1;
    }

    // Add format
    lxw_format *format = workbook_add_format(workbook);
    if (!format) {
        workbook_close(workbook);
        return 1;
    }

    // Set invalid pattern value - triggers the vulnerability
    format_set_pattern(format, 19);

    // Use the format (required to trigger the bug during close)
    worksheet_write_string(worksheet, 0, 0, "Test", format);

    // This will crash in _write_fill()
    workbook_close(workbook);

    return 0;
}

Expected Behavior

The function should either:

Accept only valid pattern values and reject invalid ones with an error
Handle invalid pattern values gracefully without causing memory corruption

Actual Behavior

The program crashes with a global buffer overflow:

==56525==ERROR: AddressSanitizer: global-buffer-overflow on address 0x556a9faf5c18
READ of size 8 at 0x556a9faf5c18 thread T0
    #0 0x556a9fa67c5a in _write_fill /src/libxlsxwriter/src/styles.c:732:35
    #1 0x556a9fa62bff in _write_fills /src/libxlsxwriter/src/styles.c:777:13
    #2 0x556a9fa62bff in lxw_styles_assemble_xml_file /src/libxlsxwriter/src/styles.c:1426:5
    #3 0x556a9fa53e5f in _write_styles_file /src/libxlsxwriter/src/packager.c:1417:5
    #4 0x556a9fa4fea1 in lxw_create_package /src/libxlsxwriter/src/packager.c:2211:13
    #5 0x556a9f9b82f7 in workbook_close /src/libxlsxwriter/src/workbook.c:2299:13

Proposed Fix

Add bounds checking in format_set_pattern():

 if (pattern > LXW_PATTERN_GRAY_0625) {  
       LXW_WARN_FORMAT1("Invalid pattern value: %d, using LXW_PATTERN_NONE instead", pattern);
       pattern = LXW_PATTERN_NONE;  
   }

Additional Information

This bug was discovered through fuzz testing.

Originally created by @LkkkLxy on GitHub (Sep 30, 2025). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/487 ## Summary A global buffer overflow vulnerability exists in the libxlsxwriter library when using `format_set_pattern()` with invalid pattern values. This can lead to memory corruption and program crashes. ## Environment - **Library Version**: Latest (as of analysis) - **Platform**: Linux x86_64 - **Compiler**: clang with AddressSanitizer - **Detection Tool**: AddressSanitizer ## Vulnerability Details - **Type**: Global buffer overflow - **Location**: `_write_fill()` function in `/src/libxlsxwriter/src/styles.c:732` - **Affected Function**: `format_set_pattern()` ## Root Cause The `format_set_pattern()` function accepts pattern values without proper bounds checking. When an invalid pattern value (e.g., 19) is used, it causes an out-of-bounds access in the `_write_fill()` function during workbook serialization. The `patterns` array in `_write_fill()` has a fixed size that doesn't accommodate all possible pattern values. ## Steps to Reproduce 1. Compile the following test program with AddressSanitizer: ```bash clang test.c -o test -fsanitize=address -I<libxlsxwriter_include_path> -lxlsxwriter -lz ``` 2. Run the test program: ```c #include <xlsxwriter.h> #include <stdio.h> int main() { // Create workbook lxw_workbook *workbook = workbook_new("test.xlsx"); if (!workbook) return 1; // Add worksheet lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL); if (!worksheet) { workbook_close(workbook); return 1; } // Add format lxw_format *format = workbook_add_format(workbook); if (!format) { workbook_close(workbook); return 1; } // Set invalid pattern value - triggers the vulnerability format_set_pattern(format, 19); // Use the format (required to trigger the bug during close) worksheet_write_string(worksheet, 0, 0, "Test", format); // This will crash in _write_fill() workbook_close(workbook); return 0; } ``` ## Expected Behavior The function should either: 1. Accept only valid pattern values and reject invalid ones with an error 2. Handle invalid pattern values gracefully without causing memory corruption ## Actual Behavior The program crashes with a global buffer overflow: ``` ==56525==ERROR: AddressSanitizer: global-buffer-overflow on address 0x556a9faf5c18 READ of size 8 at 0x556a9faf5c18 thread T0 #0 0x556a9fa67c5a in _write_fill /src/libxlsxwriter/src/styles.c:732:35 #1 0x556a9fa62bff in _write_fills /src/libxlsxwriter/src/styles.c:777:13 #2 0x556a9fa62bff in lxw_styles_assemble_xml_file /src/libxlsxwriter/src/styles.c:1426:5 #3 0x556a9fa53e5f in _write_styles_file /src/libxlsxwriter/src/packager.c:1417:5 #4 0x556a9fa4fea1 in lxw_create_package /src/libxlsxwriter/src/packager.c:2211:13 #5 0x556a9f9b82f7 in workbook_close /src/libxlsxwriter/src/workbook.c:2299:13 ``` ## Proposed Fix 1. **Add bounds checking in `format_set_pattern()`**: ```c if (pattern > LXW_PATTERN_GRAY_0625) { LXW_WARN_FORMAT1("Invalid pattern value: %d, using LXW_PATTERN_NONE instead", pattern); pattern = LXW_PATTERN_NONE; } ``` ## Additional Information This bug was discovered through fuzz testing.