[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Bug default/30067] New: Heap buffer overflow found by libfuzzer in pkl_
|
From: |
dan.cermak at posteo dot net |
|
Subject: |
[Bug default/30067] New: Heap buffer overflow found by libfuzzer in pkl_tab_lex |
|
Date: |
Wed, 01 Feb 2023 16:36:28 +0000 |
https://sourceware.org/bugzilla/show_bug.cgi?id=30067
Bug ID: 30067
Summary: Heap buffer overflow found by libfuzzer in pkl_tab_lex
Product: poke
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: default
Assignee: unassigned at sourceware dot org
Reporter: dan.cermak at posteo dot net
CC: poke-devel at gnu dot org
Target Milestone: ---
Created attachment 14648
--> https://sourceware.org/bugzilla/attachment.cgi?id=14648&action=edit
crashing file
The attached file was created by libfuzzer using the code in the branch
defolos/fuzzer. It caused the following heap-buffer-overflow (detected with
ASAN):
❯ ./a.out crash-3bfd324b5e6a6852dc5fb17de49c4a740a8ff280
=================================================================
==1467405==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x631000010808 at pc 0x000000914639 bp 0x7ffe53828350 sp 0x7ffe53828348
WRITE of size 4 at 0x631000010808 thread T0
#0 0x914638 in pkl_tab_lex
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-lex.c:1696:25
#1 0x8a8cea in pkl_tab_parse
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-tab.c:5344:16
#2 0x7cbdc4 in pkl_parse_buffer
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-parser.c:171:9
#3 0x51d383 in parse_buffer
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl.c:993:3
#4 0x5179b9 in LLVMFuzzerTestOneInput
/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/fuzz_compiler.c:20:3
#5 0x517c88 in main
/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/fuzz_compiler.c:50:10
#6 0x7f84a3a4a50f in __libc_start_call_main
/usr/src/debug/glibc-2.36-9.fc37.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#7 0x7f84a3a4a5c8 in __libc_start_main@GLIBC_2.2.5
/usr/src/debug/glibc-2.36-9.fc37.x86_64/csu/../csu/libc-start.c:381:3
#8 0x41f324 in _start
(/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/a.out+0x41f324)
(BuildId: ca808a8f58fb7570eb8c66ef066ce159c90fd7f5)
0x631000010808 is located 0 bytes to the right of 65544-byte region
[0x631000000800,0x631000010808)
allocated by thread T0 here:
#0 0x4d40b7 in malloc
(/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/a.out+0x4d40b7)
(BuildId: ca808a8f58fb7570eb8c66ef066ce159c90fd7f5)
#1 0x8d6b69 in pkl_tab_alloc
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-lex.c:3933:9
#2 0x8d6b69 in pkl_tab_lex
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-lex.c:1617:50
#3 0x8a8cea in pkl_tab_parse
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-tab.c:5344:16
#4 0x7cbdc4 in pkl_parse_buffer
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-parser.c:171:9
#5 0x51d383 in parse_buffer
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl.c:993:3
#6 0x5179b9 in LLVMFuzzerTestOneInput
/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/fuzz_compiler.c:20:3
#7 0x517c88 in main
/home/dan/packages/git.savannah.nongnu.org/git/poke/fuzz/fuzz_compiler.c:50:10
#8 0x7f84a3a4a50f in __libc_start_call_main
/usr/src/debug/glibc-2.36-9.fc37.x86_64/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/dan/packages/git.savannah.nongnu.org/git/poke/libpoke/pkl-lex.c:1696:25
in pkl_tab_lex
Shadow bytes around the buggy address:
0x0c627fffa0b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa0c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa0d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa0e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c627fffa0f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c627fffa100: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c627fffa150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1467405==ABORTING
When you load the file via poke 3.0 itself, then you get a failure instead:
❯ poke -L crash-3bfd324b5e6a6852dc5fb17de49c4a740a8ff280
4:9: internal compiler error: input buffer overflow, can't enlarge buffer
because scanner uses REJECT
Important information has been dumped in /tmp/pokeIzFLf7.
Please attach it to a bug report and send it to poke-devel@gnu.org.
--
You are receiving this mail because:
You are on the CC list for the bug.
| [Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Bug default/30067] New: Heap buffer overflow found by libfuzzer in pkl_tab_lex,
dan.cermak at posteo dot net <=