Infinite loop Affecting openmcdf package, versions [,3.1.4)

OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage.

Affected versions of this package are vulnerable to Infinite loop involving the TryGetDirectoryEntry() function, which is accessible via RootStorage.OpenStorage() and RootStorage.OpenStream(). An attacker can cause a thread to enter an uncaught and unrecoverable loop by providing a malicious CFB file with cyclic sibling directory entries. Cycles are properly detected for DirectoryTreeEnumerator, but individual entry lookups are vulnerable to the pattern described here.

using OpenMcdf;

using var fs = File.OpenRead("repro_enumerate.cfb");
using var root = RootStorage.Open(fs);
foreach (var entry in root.EnumerateEntries())   // safe: Brent's catches enumeration cycles
{
    if (entry.Type == EntryType.Stream)
        _ = root.OpenStream(entry.Name);          // hangs: lookup path has no cycle detection
}

• GitHub Advisory
• GitHub Commit