bugGNU cflow - Bugs: bug #44113, Malformed file causes cflow to...

 
 

bug #44113: Malformed file causes cflow to segfault

Submitted by:  Brian Carpenter <geeknik>
Submitted on:  Thu 29 Jan 2015 01:05:54 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Sergey Poznyakoff <gray>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 22 Mar 2016 11:18:34 AM UTC, comment #3:

Fixed in the repository (03b73146). Thank you.

Sergey Poznyakoff <gray>
Project AdministratorIn charge of this item.
Sun 12 Jul 2015 08:29:08 PM UTC, comment #2:

I also found a couple more via afl-fuzz (minimized). Looks like cflow is sensitive to a missing closing brace, which is consistent with Brian's find.

$ cat test1.c
m{int
r(a(n){}e
$ cflow test1.c
Segmentation fault

$ cat test2.c
e(S,t)e(S{
$ cflow test2.c
Segmentation fault

There's an unmatched open brace there

Michael <mdunphy>
Sun 12 Jul 2015 07:28:13 PM UTC, comment #1:

afl-tmin reduces the malformed file to a short string:

n{void y(r(i){}a

(might aid in debugging...)

Michael <mdunphy>
Thu 29 Jan 2015 01:05:54 AM UTC, original submission:

I'm fuzzing cflow with american fuzzy lop (http://lcamtuf.coredump.cx/afl/). I compiled the app using afl-gcc like so:

CC=/path/to/afl-gcc ./configure
AFL_HARDEN=1 make

Here is the valgrind and gdb output:
=8312== Invalid read of size 8
==8312== at 0x43142A: expression (parser.c:1154)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid write of size 8
==8312== at 0x41D604: linked_list_append (linked-list.c:28)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x431A1A: expression (parser.c:1140)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x431B55: expression (parser.c:1141)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x431A1A: expression (parser.c:1140)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x431B55: expression (parser.c:1141)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x43142A: expression (parser.c:1154)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (R):
malloc()
size()
rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (recursive: see 1)
rand()

warning: Can't read pathname for load map: Input/output error.
Core was generated by `/home/geeknik/cflow-1.4/src/cflow id:000000,sig:11,src:000001,op:havoc,rep:16'.
Program terminated with signal 11, Segmentation fault.
#0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
144 for (p = linked_list_head(list); p; p = p->next)
(gdb) bt
#0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
#1 0x0000000000431436 in reference (line=<optimized out>, name=<optimized out>) at parser.c:1154
#2 expression () at parser.c:475
#3 0x000000000043a16f in parse_variable_declaration (ident=ident@entry=0x7fffffffe080, parm=parm@entry=1) at parser.c:636
#4 0x000000000043410d in parse_declaration (parm=1, ident=0x7fffffffe080) at parser.c:434
#5 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe13c) at parser.c:873
#6 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:804
#7 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:771
#8 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe130) at parser.c:734
#9 parse_variable_declaration (ident=ident@entry=0x7fffffffe130, parm=parm@entry=0) at parser.c:610
#10 0x0000000000432c0a in func_body () at parser.c:919
#11 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#12 0x0000000000434ab5 in parse_declaration (parm=1, ident=0x7fffffffe160) at parser.c:432
#13 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe21c) at parser.c:873
#14 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:804
#15 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:771
#16 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe210) at parser.c:734
#17 parse_variable_declaration (ident=ident@entry=0x7fffffffe210, parm=parm@entry=0) at parser.c:610
#18 0x0000000000432c0a in func_body () at parser.c:919
#19 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#20 0x000000000043b8d5 in parse_declaration (parm=0, ident=0x7fffffffe240) at parser.c:432
#21 yyparse () at parser.c:385
#22 0x0000000000402da5 in main (argc=2, argv=0x7fffffffe378) at main.c:796
#23 0x00007ffff7a6fead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>,
---Type <return> to continue, or q <return> to quit---
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe368) at libc-start.c:244
#24 0x0000000000402ed9 in _start ()
(gdb) i r
rax 0x0 0
rbx 0x0 0
rcx 0x69b920 6928672
rdx 0x69b930 6928688
rsi 0x20 32
rdi 0x69aff0 6926320
rbp 0x69aff0 0x69aff0
rsp 0x7fffffffdff0 0x7fffffffdff0
r8 0x69b920 6928672
r9 0x10 16
r10 0xc 12
r11 0xb 11
r12 0x1a 26
r13 0x48 72
r14 0x0 0
r15 0x0 0
rip 0x41e2c0 0x41e2c0 <data_in_list+88>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0

I've attached the test case and the core dump.

Brian Carpenter <geeknik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #32931:  cflow-1.4-crash.tar.gz added by geeknik (22KiB - application/x-gzip - crashing test case and core dump)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Posted a comment)
  • -unavailable- added by mdunphy (Posted a comment)
  • -unavailable- added by geeknik (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 25 Jul 2017 03:03:39 PM UTCgrayOpen/ClosedOpen=>Closed
    Tue 22 Mar 2016 11:18:52 AM UTCgrayStatusNone=>Fixed
    Tue 22 Mar 2016 11:18:34 AM UTCgrayAssigned toNone=>gray
    Thu 29 Jan 2015 01:05:54 AM UTCgeeknikAttached File-=>Added cflow-1.4-crash.tar.gz, #32931

    Back to the top


    Powered by Savane 3.1-cleanup1