A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files.<\/p>\n
In objects\/network\/bus.c, bus_load() reads the number of bus handles from the file attribute “bus_handles” using attribute_num_data() without validating an upper bound:<\/p>\n
bus->num_handles = attribute_num_data(attr);<\/p>\n
When a bus handle is subsequently moved, bus_handle_moved() allocates two temporary arrays on the stack:<\/p>\n
parallel = (real *)g_alloca(num_handles * sizeof(real));
\n perp = (real *)g_alloca(num_handles * sizeof(real));<\/p>\n
Because num_handles is fully attacker-controlled via the project file, sufficiently large values (for example 262144 or higher) cause g_alloca() to consume more stack space than the default thread stack limit (typically 8 MB on Linux), resulting in stack overflow, SIGSEGV, and potential stack frame \/ return-address corruption.<\/p>\n
An attacker can embed a Bus object with an excessive bus_handles count in a malicious .dia file. Exploitation requires the victim to open the file in Dia (file dialog, command line, or file association) and trigger handle manipulation (moving a bus handle), which exercises the vulnerable code path.<\/p>\n
The identical g_alloca pattern is present in objects\/Misc\/tree.c (copied from bus.c) and is likely vulnerable to the same class of attack via Tree objects.<\/p>\n
Affected versions: Dia 0.98.0 and earlier versions containing this code; issue confirmed on upstream master as of 2026-08-21.
\nUpstream report: https:\/\/gitlab.gnome.org\/GNOME\/dia\/-\/issues\/581<\/p>\n","protected":false},"excerpt":{"rendered":"
A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files.<\/p>\n
In objects\/network\/bus.c, bus_load() reads the number of b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11909","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}