Fuzzing between the lines in popular barcode software

Summary: Trail of Bits fuzzed the open-source ZBar barcode scanning library, which had no public record of prior fuzzing, and found an out-of-bounds stack buffer write enabling arbitrary code execution via a malicious barcode, plus a memory leak usable for denial-of-service. The stack write was independently reported around the same time, assigned CVE-2023-40890, and fixed in commit 012a030; the leak, in _zbar_sq_decode, scales with image border size at roughly border/2 * 8 * 3 bytes, so a 512-pixel border leaks 6KiB, and the maintainer had not responded to the reported patch after an extended period.
Bottom line: A library that decodes barcodes and QR codes by default scans every supported format, so an attacker can reach a bug in any scanner through an image your application accepts - and a 6KiB leak per scan is enough to exhaust memory in a service that repeatedly processes untrusted codes.

Read the original at Trail of Bits Blog ↗