An exploitable integer overflow exists in the BKE_mesh_calc_normals_tessface functionality of the Blender open-source 3d creation suite. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open a .blend file in order to trigger this vulnerability.
This vulnerability exists with how the Blender application fixes the normals within a Mesh object when loading an older version of a .blend file. When allocating space for the faces and vertices of a Mesh object, the application will perform some arithmetic which can overflow. This will then be used to perform an allocation which can allow for an undersized buffer. Later when the application attempts to calculate the normals for the vertices and faces of the mesh, the application will write outside the bounds of the buffer resulting in a heap-based buffer overflow.
After initially loading the file, the application will call the blo_do_versions_250 function. This function will check the version of the file as specified in the FileGlobals structure. At , if the version is less than 256 (exclusive) or the version is equal to 256 and sub-version is less than 6 then the application will iterate through all of the Mesh data-blocks with the Code 'ME\x00\x00' that were read from the file. For each of these Mesh objects, the function BKE_mesh_calc_normals_tessface will be called at . The arguments that are passed to this function come from the Mesh object. The fields that are directly responsible for this vulnerability are the totvert and the totface fields of the Mesh structure.
Once inside the BKE_mesh_calc_normals_tessface function, the application will take the values from the totface and totvert fields and use them to perform a multiplication at  in order to allocate space for the calculations required for both the faces and vertices of the mesh. The size of both fields are a 4 for a float, and 3 for three of them. This results in the multiplication for both allocations being 12 and the totvert field or the totface field. If the result of this product is larger than 32-bits then an integer overflow will occur. This will cause the memory that is allocated to be undersized. Later at , the application will use one of these undersized buffers to calculate the normals of each face of the Mesh. Also at , the normals for each vertex will be calculated. The provided-proof-of-concept utilizes the calculation of the normal for each vertex in order to corrupt memory and trigger the vulnerability. At , the application will store the normal that was calculated into the buffer that was allocated corrupting memory outside the bounds of the allocated buffer. This type of memory corruption could allow for code execution under the context of the application.
01b83423 66894708        mov     word ptr [edi+8],ax      ds:002b:0da3e000=????
0da3dff8  00000000 00000000 ???????? ????????  ........????????
0da3e008  ???????? ???????? ???????? ????????  ????????????????
0da3e018  ???????? ???????? ???????? ????????  ????????????????
0da3e028  ???????? ???????? ???????? ????????  ????????????????
0da3e038  ???????? ???????? ???????? ????????  ????????????????
0da3e048  ???????? ???????? ???????? ????????  ????????????????
0da3e058  ???????? ???????? ???????? ????????  ????????????????
0da3e068  ???????? ???????? ???????? ????????  ????????????????