FLTK through 1.4.5 Heap Buffer Overflow via Fl_BMP_Image Integer Overflow

Summary

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.

Remediation

1. Inventory every fltk fltk deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1
• Advisoryhttps://hackmd.io/@haindpwn/fltk-bmp-image-stack-heap-overflow
• Advisoryhttps://www.vulncheck.com/advisories/fltk-through-1.4.5-heap-buffer-overflow-via-fl-bmp-image-integer-overflow
• Referencehttps://github.com/fltk/fltk
• Referencehttps://github.com/fltk/fltk/blob/release-1.4.5/src/Fl_BMP_Image.cxx#L281-L286
• Referencehttps://github.com/fltk/fltk/issues/1632