ANT-2026-PVQH654C: Heap-buffer-overflow in mitab_tabfile.cpp:97

During GDALVectorTranslate (ogr2ogr) output to the MapInfo TAB format, TABFile::WriteTABFile() calls EscapeString(), which allocates a 201-byte buffer via CPLMalloc (mitab_tabfile.cpp:60) and then writes past its end at mitab_tabfile.cpp:97. ASAN reports a WRITE of size 1 immediately after the allocated region. The overflow is reachable by converting a crafted vector input to TAB format, and results in heap metadata/adjacent-allocation corruption.

Target

Project: gdal
Location: mitab_tabfile.cpp:97

Technical Details

ASAN: "WRITE of size 1 at 0x7b003b2f2a89 ... 0 bytes after 201-byte region". The destination buffer for the escaped string is sized at allocation (line 60) without accounting for the full expansion performed by the escaping loop, so the write at line 97 lands one byte past the end of the heap allocation.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2244030142
INFO: Loaded 1 modules   (1157944 inline 8-bit counters): 1157944 [0x60e6ecc00a60, 0x60e6ecd1b598), 
INFO: Loaded 1 PC tables (1157944 PCs): 1157944 [0x60e6ecd1b598,0x60e6edec6918), 
/out/gdal_vector_translate_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==27==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7b003b2f2a89 at pc 0x60e6e6c767d4 bp 0x7fff202d02d0 sp 0x7fff202d02c8
WRITE of size 1 at 0x7b003b2f2a89 thread T0
    #0 0x60e6e6c767d3 in EscapeString /src/gdal/ogr/ogrsf_frmts/mitab/mitab_tabfile.cpp:97:21
    #1 0x60e6e6c767d3 in TABFile::WriteTABFile() /src/gdal/ogr/ogrsf_frmts/mitab/mitab_tabfile.cpp:1105:21
    #2 0x60e6e6c7f2ee in TABFile::SyncToDisk() /src/gdal/ogr/ogrsf_frmts/mitab/mitab_tabfile.cpp:2929:9
    #3 0x60e6e5d5031b in GDALDataset::FlushCache(bool) /src/gdal/gcore/gdaldataset.cpp:753:30
    #4 0x60e6e618324b in GDALVectorTranslate /src/gdal/apps/ogr2ogr_lib.cpp:3841:16
    #5 0x60e6e549f0e3 in LLVMFuzzerTestOneInput /src/gdal/./fuzzers/gdal_vector_translate_fuzzer.cpp:127:17
    #6 0x60e6e533ad6d in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #7 0x60e6e5325af2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:329:6
    [... 20 more frames — full trace in crash.log]

Reproduction

Reproduce against the target as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-PVQH654C.

Reference: ANT-2026-PVQH654C
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure