libvips Heap-Based Buffer Overflow Vulnerability in CSV Loading Function

A heap-based buffer overflow vulnerability has been identified in libvips versions through 8.18.0. The issue arises in the CSV loading function, vips_foreign_load_csv_build, within the file libvips/foreign/csvload.c. The vulnerability is triggered by using non-ASCII characters in the whitespace and separator options, which can corrupt adjacent memory. This vulnerability requires local access to exploit.

Impact

Exploitation of this vulnerability leads to a heap-based buffer overflow, allowing for potential memory corruption.

Reproduction

The vulnerability can be reproduced by building libvips with AddressSanitizer enabled, preparing a CSV file, and then using the 'vips csvload' command with a non-ASCII whitespace option, such as an emoji. The AddressSanitizer will report the heap-buffer-overflow error, indicating that the vulnerability has been successfully exploited.

Remediation

Users are advised to update to libvips version 8.19.0 or later, where this vulnerability has been patched.