bugunrtf - Bugs: bug #44650, parsing config file with zero byte...

 
 

bug #44650: parsing config file with zero byte creates invalid memory access

Submitter:  Hanno Boeck <hanno>
Submitted:  Fri 27 Mar 2015 12:47:16 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  medoc Open/Closed:  Closed
Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 12 Jun 2015 05:52:33 AM UTC, comment #1: 

OOps, this was (hopefully) fixed 2 months ago by:

http://hg.savannah.gnu.org/hgweb/unrtf/rev/e79d1d2407ac

Forgot to close the issue, doing it.

Jean-Francois Dockes <medoc>
Group administrator
Fri 27 Mar 2015 12:47:16 PM UTC, original submission:  

When the unrtf output config contains a zero byte with a following newline this creates an invalid memory read access / stack buffer underflow in unrtf.

  • Reproduce:

Compile and build unrtf with address sanitizer:
./bootstrap; ./configure CFLAGS="-fsanitize=address"; make
Replace html output conf with zero byte + newline:
echo -e '\x00' > outputs/html.conf
Run unrtf with that file:
src/unrtf -P outputs/

(It may be argued that this is not a real issue because malformed config files are unexpected, but I'd say to be safe all parser code should be able to handle malformed input in a sane way)

I'll attach the address sanitizer output and the malformed input file. (Issue found with american fuzzy lop.)

Relevant part of Address Sanitizer output:
==15660==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd94c2dc3f at pc 0x41d457 bp 0x7ffd94c2dbf0 sp 0x7ffd94c2dbe0
READ of size 1 at 0x7ffd94c2dc3f thread T0
    #0 0x41d456 in user_init (/tmp/unrtf-0.21.9/src/unrtf+0x41d456)
    #1 0x414084 in get_config (/tmp/unrtf-0.21.9/src/unrtf+0x414084)
    #2 0x414b79 in main (/tmp/unrtf-0.21.9/src/unrtf+0x414b79)
    #3 0x7fba3af50f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
    #4 0x401bd8 (/tmp/unrtf-0.21.9/src/unrtf+0x401bd8)

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #33467:  html.conf added by hanno (2B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by medoc (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-06-12 medoc Open/ClosedOpen Closed
    2015-06-12 medoc StatusNone Fixed
        Assigned toNone medoc
    2015-03-27 hanno Attached File- Added unrtf-malformed-output-conf.asan.log, #33466
        Attached File- Added html.conf, #33467

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code