Buffer Over-Read in GLib via g_regex_replace

Executive Summary

This vulnerability exists in the GLib library's g_regex_replace() function when it is used with the G_REGEX_RAW compile flag and case-change replacement escapes such as \U, \L, \u, and \l.

In G_REGEX_RAW mode, the function treats the input string as raw bytes rather than UTF-8 encoded text. However, the internal string_append() function processes matched substrings using UTF-8 functions that assume the input is valid UTF-8.

If the matched substring contains arbitrary byte sequences that are not valid UTF-8, this mismatch can cause the function to read beyond the allocated buffer, leading to a heap-buffer-overflow read.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to two main impacts:

• Minor information disclosure of 1-5 bytes due to buffer over-read.
• Denial of service (DoS) if the buffer over-read crosses a memory page boundary, potentially crashing the application.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update GLib to a version where the g_regex_replace function properly handles the G_REGEX_RAW compile flag and case-change replacement escapes, preventing buffer over-read.

Avoid using the g_regex_replace function with the G_REGEX_RAW flag combined with case-change replacement escapes (\U, \L, \u, \l) until a patched version is applied.

Useful 0 Not Useful 0