bugGNU gettext - Bugs: bug #47531, One byte heap buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47531: One byte heap buffer overflow in x-lua.c (triggered by make check)

Submitter:  Hanno Boeck <hanno>
Submitted:  Fri 25 Mar 2016 01:02:44 PM UTC
 
Category:  Lua Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  ueno
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Fri 25 Mar 2016 07:24:45 PM UTC, comment #1: 
Daiki Ueno <ueno>
Project Administrator
Fri 25 Mar 2016 01:02:44 PM UTC, original submission:  

There is a one byte heap buffer overflow in x-lua.c. This is the code:

static void
string_end ()
{
  string_buf[string_buf_length] = '\0';
}

The problem is that when string_buf_length is larger than string_buf it will still write. In the function above (string_add) there is a check for that and a call to xrealloc in that case. See attached patch for a similar change to string_end (I realloc only one additional byte because I assume after string_end no more memory is needed).

This was found by running the test suite (make check) with address sanitizer enabled. I'll attach the address sanitizer error message as well.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  • -email is unavailable- added by ueno (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-11-27 haible CategoryNone Lua
        Assigned toNone ueno
    2016-03-25 ueno StatusNone Fixed
        Open/ClosedOpen Closed
    2016-03-25 hanno Attached File- Added gettext-fix-bufferoverflow.diff, #36761
        Attached File- Added gettext-lua-overflow-asan.txt, #36762

    Back to the top


    Powered by Savane 3.9