Executive brief
Open Chinese Convert (OpenCC) is a library used to convert between Traditional and Simplified Chinese characters. A flaw in how it reads dictionary files (.ocd format) allows attackers to craft a malicious file that causes the application to crash, disrupting any service that depends on this library for language conversion functionality.
Technical details
The vulnerability is an out-of-bounds read in BinaryDict::NewFromFile (BinaryDict.cpp) where keyOffset and valueOffset values parsed from a crafted .ocd file can be set to arbitrary values. This causes pointer dereferences to access invalid memory, resulting in a segmentation fault and denial of service. The attack requires only that an application processes a user-supplied or attacker-controlled .ocd dictionary file; no authentication or network access is required. The vulnerability affects OpenCC versions prior to 1.1.2, with patches available in the referenced pull requests.
Affected products
- OpenCC OpenCC prior to 1.1.2
Timeline
- 2018-09-13: disclosed
- 2018: patched: Fixes available in PR #309 and #560