bugGNU cflow - Bugs: bug #44113, Malformed file causes cflow to...

 
 

bug #44113: Malformed file causes cflow to segfault

Submitter:  Brian Carpenter <geeknik>
Submitted:  Thu 29 Jan 2015 01:05:54 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  gray
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 22 Mar 2016 11:18:34 AM UTC, comment #3: 

Fixed in the repository (03b73146). Thank you.

 Sergey Poznyakoff <gray>
Group administrator
Sun 12 Jul 2015 08:29:08 PM UTC, comment #2: 

I also found a couple more via afl-fuzz (minimized). Looks like cflow is sensitive to a missing closing brace, which is consistent with Brian's find.

$ cat test1.c
m{int
r(a(n){}e
$ cflow test1.c
Segmentation fault

$ cat test2.c
e(S,t)e(S{
$ cflow test2.c
Segmentation fault



There's an unmatched open brace there

 Michael <mdunphy>
Sun 12 Jul 2015 07:28:13 PM UTC, comment #1: 

afl-tmin reduces the malformed file to a short string:

n{void y(r(i){}a

(might aid in debugging...)

 Michael <mdunphy>
Thu 29 Jan 2015 01:05:54 AM UTC, original submission:  

I'm fuzzing cflow with american fuzzy lop (http://lcamtuf.coredump.cx/afl/). I compiled the app using afl-gcc like so:

CC=/path/to/afl-gcc ./configure
AFL_HARDEN=1 make

Here is the valgrind and gdb output:
=8312== Invalid read of size 8
==8312==    at 0x43142A: expression (parser.c:1154)
==8312==    by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312==    by 0x43410C: maybe_parm_list (parser.c:434)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x41D42E: linked_list_append (linked-list.c:24)
==8312==    by 0x43148D: expression (parser.c:1155)
==8312==    by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312==    by 0x43410C: maybe_parm_list (parser.c:434)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid write of size 8
==8312==    at 0x41D604: linked_list_append (linked-list.c:28)
==8312==    by 0x43148D: expression (parser.c:1155)
==8312==    by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312==    by 0x43410C: maybe_parm_list (parser.c:434)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x431A1A: expression (parser.c:1140)
==8312==    by 0x432A2E: func_body (parser.c:909)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x41D42E: linked_list_append (linked-list.c:24)
==8312==    by 0x431B55: expression (parser.c:1141)
==8312==    by 0x432A2E: func_body (parser.c:909)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x431A1A: expression (parser.c:1140)
==8312==    by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x41D42E: linked_list_append (linked-list.c:24)
==8312==    by 0x431B55: expression (parser.c:1141)
==8312==    by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x43142A: expression (parser.c:1154)
==8312==    by 0x432A2E: func_body (parser.c:909)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312==    at 0x41D42E: linked_list_append (linked-list.c:24)
==8312==    by 0x43148D: expression (parser.c:1155)
==8312==    by 0x432A2E: func_body (parser.c:909)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==  Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312==    at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312==    by 0x4401B0: delete_level_autos (symbol.c:206)
==8312==    by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312==    by 0x4425A3: delete_autos (symbol.c:276)
==8312==    by 0x432D8A: func_body (parser.c:941)
==8312==    by 0x434AB4: maybe_parm_list (parser.c:432)
==8312==    by 0x43507F: dirdcl (parser.c:804)
==8312==    by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312==    by 0x432C09: func_body (parser.c:919)
==8312==    by 0x43B8D4: yyparse (parser.c:432)
==8312==    by 0x402DA4: main (main.c:796)
==8312==
rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (R):
    malloc()
    size()
    rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (recursive: see 1)
    rand()


warning: Can't read pathname for load map: Input/output error.
Core was generated by `/home/geeknik/cflow-1.4/src/cflow id:000000,sig:11,src:000001,op:havoc,rep:16'.
Program terminated with signal 11, Segmentation fault.
#0  0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
144      for (p = linked_list_head(list); p; p = p->next)
(gdb) bt
#0  0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
#1  0x0000000000431436 in reference (line=<optimized out>, name=<optimized out>) at parser.c:1154
#2  expression () at parser.c:475
#3  0x000000000043a16f in parse_variable_declaration (ident=ident@entry=0x7fffffffe080, parm=parm@entry=1) at parser.c:636
#4  0x000000000043410d in parse_declaration (parm=1, ident=0x7fffffffe080) at parser.c:434
#5  maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe13c) at parser.c:873
#6  0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:804
#7  0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:771
#8  0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe130) at parser.c:734
#9  parse_variable_declaration (ident=ident@entry=0x7fffffffe130, parm=parm@entry=0) at parser.c:610
#10 0x0000000000432c0a in func_body () at parser.c:919
#11 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#12 0x0000000000434ab5 in parse_declaration (parm=1, ident=0x7fffffffe160) at parser.c:432
#13 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe21c) at parser.c:873
#14 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:804
#15 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:771
#16 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe210) at parser.c:734
#17 parse_variable_declaration (ident=ident@entry=0x7fffffffe210, parm=parm@entry=0) at parser.c:610
#18 0x0000000000432c0a in func_body () at parser.c:919
#19 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#20 0x000000000043b8d5 in parse_declaration (parm=0, ident=0x7fffffffe240) at parser.c:432
#21 yyparse () at parser.c:385
#22 0x0000000000402da5 in main (argc=2, argv=0x7fffffffe378) at main.c:796
#23 0x00007ffff7a6fead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>,
---Type <return> to continue, or q <return> to quit---
    init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe368) at libc-start.c:244
#24 0x0000000000402ed9 in _start ()
(gdb) i r
rax            0x0 0
rbx            0x0 0
rcx            0x69b920 6928672
rdx            0x69b930 6928688
rsi            0x20 32
rdi            0x69aff0 6926320
rbp            0x69aff0 0x69aff0
rsp            0x7fffffffdff0 0x7fffffffdff0
r8             0x69b920 6928672
r9             0x10 16
r10            0xc 12
r11            0xb 11
r12            0x1a 26
r13            0x48 72
r14            0x0 0
r15            0x0 0
rip            0x41e2c0 0x41e2c0 <data_in_list+88>
eflags         0x10202 [ IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0

I've attached the test case and the core dump.

 Brian Carpenter <geeknik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #32931:  cflow-1.4-crash.tar.gz added by geeknik (22KiB - application/x-gzip - crashing test case and core dump)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by mdunphy (Posted a comment)
  • -email is unavailable- added by geeknik (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-25 gray Open/ClosedOpen Closed
    2016-03-22 gray StatusNone Fixed
    2016-03-22 gray Assigned toNone gray
    2015-01-29 geeknik Attached File- Added cflow-1.4-crash.tar.gz, #32931

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-54b4.
    Corresponding source code