SAIL Image Decoding Library PCX Heap-Based Buffer Overflow Vulnerability Allowing Remote Code Execution

A memory corruption vulnerability has been identified in the PCX image decoding feature of the SAIL Image Decoding Library version 0.9.8. This vulnerability arises when the library processes a specially crafted .pcx file, leading to a heap-based buffer overflow that can be exploited for remote code execution. The issue occurs because the library can be manipulated into reading a file that triggers the vulnerability.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution in the context of the application using the SAIL Image Decoding Library.

Reproduction

The vulnerability can be reproduced by using the SAIL Image Decoding Library to decode a crafted PCX file that exploits the buffer overflow. This can be done by creating a .pcx file that, when processed by the library, causes the decoding function to write beyond the allocated buffer. The AddressSanitizer can be used to detect the heap-buffer-overflow error, confirming that the vulnerability has been successfully exploited.

Remediation

Users are advised to update to the patched version of the SAIL Image Decoding Library. The latest version can be obtained from the official SAIL website.