Description
libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar() to index a NULL high_font_data_xbin pointer and terminate the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ansilove libansilove
Default version status: unaffected
1.3.0 to ≤ 1.4.2affected
pkg:github/ansilove/libansiloveReferences
- https://hackmd.io/@haind-pwn/libansilove-xbin-rle-oob-read-and-null-font-deref ↗
- https://github.com/ansilove/libansilove/blob/f1b05447aa566aa4eef9b05ebf8c2aaf1e379cd3/src/loaders/xbin.c#L119-L166 ↗
- https://github.com/ansilove/libansilove/blob/f1b05447aa566aa4eef9b05ebf8c2aaf1e379cd3/src/loaders/xbin.c#L224-L232 ↗
- https://github.com/ansilove/libansilove/blob/f1b05447aa566aa4eef9b05ebf8c2aaf1e379cd3/src/drawchar.c#L28-L35 ↗
- https://github.com/ansilove/libansilove ↗
- https://www.vulncheck.com/advisories/libansilove-1.3.0-through-1.4.2-null-pointer-dereference-via-ansilove-xbin ↗