Bug#862708: overread of heap-data in TNEFDefaultHandler by a missing null byte

2017-05-15 Thread bingosxs
To verify this, use the testcase from: https://github.com/bingosxs/fuzzdata/raw/master/ytnef-1.9/18-TNEFDefaultHandler.tnef run the sample with command: ytnef/.libs/ytnef -v 18-TNEFDefaultHandler.tnef The tracelog is: =

Bug#862707: Heap-buffer overrun: write extra bytes in TNEFFillMapi

2017-05-15 Thread bingosxs
+ }else{ mp->data=NULL; } ALLOCCHECK(mp->data);vl = mp->data; } else { To verify this, use the testcase from: https://github.com/bingosxs/fuzzdata/raw/master/ytnef-1.9/TNEFFillMapi-over-write.tnef run the sample with command: ytnef/.libs/ytnef -v TNEFFillM

Bug#862556: heap-buffer-overflow vulnerability in the SIZECHCK

2017-05-14 Thread bingosxs
ILE__, __LINE__); return(-1); } } To verify this, use the testcase from: https://github.com/bingosxs/fuzzdata/blob/master/ytnef-1.9/TNEFFreeMapiProps-Invalid-read.tnef?raw=true run the sample with command: ytnef/.libs/ytn