REDHAT-BUG-2520890: High severity Dia vulnerability
A flaw was found in Dia's Network Bus object loader. When opening a crafted Dia project (.dia) file, the bushandles attribute supplies numhandles without validation. Later, when a bus handle is moved, bushandlemoved() allocates two arrays on the stack using galloca() sized by numhandles, which can exhaust the thread stack and cause memory corruption, application crash, or potentially arbitrary code execution. The same galloca pattern exists in objects/Misc/tree.c.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Dia users who open crafted .dia project files are exposed. The vulnerable path is reached when a Network Bus object's handle is later moved.
What does an attacker need to provide or trigger?
An attacker needs to supply a crafted Dia project file whose bus_handles attribute contains an unvalidated num_handles value. Moving a bus handle then causes stack allocations sized from that value.
Is the Network Bus loader the only relevant code location?
No. The same g_alloca allocation pattern is also present in objects/Misc/tree.c, although the provided information does not specify whether it is reachable through the same file content or workflow.