[BUG] Null pointer dereference in fileutil.c:75, catdoc #8
Description
Brief Summary
Hello, I was testing my fuzzer and found a null pointer dereference bug in catdoc. A null pointer dereference in function find_file will be triggered when parsing a crafted doc file, when running ./catdoc $POC, as shown in the attachment
Environment
Ubuntu 18.04
clang 12.0.1
catdoc latest version
step to reproduce
export CC="clang -fsanitize=address -g"
./configure --disable-shared && make -j8
./src/catdoc $POC
ASAN output
=================================================================
==352068==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f87b0d7ce78 bp 0x7fff790da7f0 sp 0x7fff790d9f88 T0)
==352068==The signal is caused by a READ memory access.
==352068==Hint: address points to the zero page.
#0 0x7f87b0d7ce78 /build/glibc-CVJwZb/glibc-2.27/string/../sysdeps/x86_64/multiarch/strchr-avx2.S:57
#1 0x43979c in __interceptor_strchr.part.39 /llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:688
#2 0x4fbb80 in find_file /latest/catdoc/src/fileutil.c:75:5
#3 0x4f3c50 in main /latest/catdoc/src/catdoc.c:50:11
#4 0x7f87b0c10c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#5 0x41baa9 in _start (/latest/catdoc/src/catdoc+0x41baa9)
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /build/glibc-CVJwZb/glibc-2.27/string/../sysdeps/x86_64/multiarch/strchr-avx2.S:57
==352068==ABORTING
Root cause
in file https://github.com/petewarden/catdoc/blob/master/src/fileutil.c#L75
q=strchr(p,LIST_SEP);
The p is not verified and can be modified to NULL with a crafted doc file.
POC
Credit
Han Zheng(NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao(NCNIPC of China)