Tesseract vulnerabilities

Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedClass in src/classify/adaptive.cpp raw-reads an ADAPT_CLASS_STRUCT from a pre-adapted-template .a file without neutralizing TempProtos and Config pointer fields before any destructor path. When the legacy engine is selected, classify_use_pre_adapted_templates is enabled, and an attacker can write the output-basename .a file, the success or rejection path can pass file-controlled pointers to ~ADAPT_CLASS_STRUCT and operator delete, causing memory corruption and denial of service.

In Tesseract prior to 5.5.4, GENERIC_2D_ARRAY::DeSerializeSize in src/ccstruct/matrix.h reads matrix dimensions as signed int32_t values and compares them only with UINT16_MAX, allowing negative values to reach ResizeNoInit. Negative dimensions or a 65535 by 65535 product can create inconsistent allocation state and later out-of-bounds accesses while loading a crafted traineddata file, causing denial of service.

In Tesseract prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service.

In Tesseract from 5.4.0 until 5.5.4, AppendLinePolygon in src/api/pagerenderer.cpp destroys the caller-owned right-to-left Pta accumulator while receiving it by value, leaving line_top_rtl_pts and line_bottom_rtl_pts dangling. On an upright Hebrew or Arabic page at the default PAGE XML level, POLYGONFLAG with a false skewed_flag enters the vulnerable calls, while LEVELFLAG greater than zero provides an alternative gate. The calls repeatedly read and free the stale object, causing a double free and use after free and allowing corrupted coordinates to reach RecalcPolygonline.

Tesseract 5.5.3 and earlier contains a flaw in Plumbing::DeSerialize that accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initialization, CacheXScaleFactor dereferences stack_[0] on the empty vector and invokes a virtual method through an invalid Network pointer.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in Classify::ReadIntTemplates, which reads NumClassPruners, NumClasses, and NumProtoSets from a .traineddata file without validating them against MAX_* limits. Oversized values cause out-of-bounds pointer writes on the heap during classifier initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in UNICHARSET::load_via_fgets, which trusts the declared unichar count as a loop bound and uses id as an unchecked index into the unichars vector. This can lead to out-of-bounds writes during initialization.

Tesseract version 5.5.3 and earlier contains a heap overflow vulnerability in GenericVector::read, which reads reserved and size_used_ fields from a .traineddata file without caps. A crafted file can set reserved to a small value and size_used_ to a large value, causing out-of-bounds writes of FontInfo structures.

In Tesseract version 5.5.3 and earlier, RecodedCharID::DeSerialize in src/ccutil/unicharcompress.h validates length_ but accepts negative code_ values from a crafted .traineddata recoder component. UnicharCompress::ComputeCodeRange can consequently produce code_range_ equal to zero, after which SetupDecoder indexes is_valid_start_ with the negative code on a size-zero vector, causing an out-of-bounds bit write and a crash or allocation failure. No fixed release is available.

Tesseract 5.5.3 and earlier fails to validate dimension consistency in NetworkIO::WriteTimeStepPart and NetworkIO::AddTimeStepPart. A crafted .traineddata file with an NT_LSTM layer can cause a heap out-of-bounds write during the first recognition step on the default LSTM engine. No fixed release is available.

Tesseract 5.5.3 and earlier does not validate the deserialized scalars ni_ and no_ against weight-matrix dimensions in FullyConnected::DeSerialize. A crafted .traineddata file with an NT_SOFTMAX layer can cause a heap out-of-bounds write and read on the default LSTM engine. No fixed release is available.

Tesseract 5.5.3 and earlier, in Classify::ReadNormProtos, extracts a whitespace-delimited token from a .traineddata file into a fixed 61-byte stack buffer without setting stream width. A token longer than 60 characters writes up to 39 attacker-controlled bytes past the buffer during TessBaseAPI::Init of the legacy engine. No fixed release is available.

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.

Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3.

In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file. The vulnerability stems from insufficient protection of temporary file operations.