Null Pointer Dereference in MAPIPrint()

[ianpastula]

Null Pointer Dereference in MAPIPrint() via crafted TNEF stream. Found via AFL++ fuzzing.

Version v2.1.2

A TNEF stream containing a MAPI string property with a zero-length value causes MAPIPrint() to pass a null pointer to strlen(), resulting in a SIGSEGV.

Call Chain:
main.c:140
→ TNEFParseFile() ytnef.c:1078
→ TNEFParse() ytnef.c:1221
→ TNEFMapiProperties() ytnef.c:410
→ MAPIPrint() ytnef.c:1474
→ strlen(NULL) ← CRASH

Steps to reproduce:

Build ytnef v2.1.2 with ASAN:
./configure CC=clang CFLAGS="-g -O1 -fsanitize=address,undefined"
make

Extract crash1_null_ptr.zip, then run:
ASAN_OPTIONS=detect_leaks=0 ./ytnef/ytnef -v -v -v crash1.tnef

Malformed File Zip:
crash1_null_ptr.zip

ASAN Output:
ytnef.c:1474:22: runtime error: null pointer passed as argument 1
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ytnef.c:1474:22
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
#0 strlen
#1 MAPIPrint ytnef.c:1474
#2 TNEFMapiProperties ytnef.c:410
#3 TNEFParse ytnef.c:1221
#4 TNEFParseFile ytnef.c:1078
#5 main main.c:140

Suggested Fix:
Add a null check before strlen() at ytnef.c:1474:

//Before:
if (strlen((char*)mapidata->data) != mapidata->size - 1) {
//After:
if (mapidata->data != NULL && strlen((char*)mapidata->data) != mapidata->size - 1){