Open Babel Null Pointer Dereference Vulnerability in PQS Format Parser

A null pointer dereference vulnerability has been identified in Open Babel versions through 3.1.1. The issue arises in the PQSFormat::ReadMolecule function within the file PQSformat.cpp. This vulnerability allows local execution of crafted inputs that trigger the dereference, leading to a segmentation fault. The problem occurs because the lowerit function is called with a pointer that may be null or not properly formatted, without any prior validation.

Impact

Exploitation of this vulnerability causes a segmentation fault, crashing the program.

Reproduction

The vulnerability can be reproduced by compiling Open Babel with the Clang compiler, version 13.0.1, using specific flags that enable AddressSanitizer and UndefinedBehaviorSanitizer. After compiling the program, the fuzzer can be run with a crafted input file that exploits the null pointer dereference. The program will crash, and the AddressSanitizer will report the segmentation fault caused by the invalid memory access.