bugCompact Disc Input and Control Library - Bugs: bug #52265, A heap-buffer-overflow...

 
 

bug #52265: A heap-buffer-overflow vulneribility in print_iso9660_recurse

Submitter:  Zhao Liang <zhao_liang>
Submitted:  Mon 23 Oct 2017 08:37:07 AM UTC
   
 
Category:  utility program Severity:  5 - Average
Item Group:  iso-info Status:  Fixed
Privacy:  Public Assigned to:  rocky
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 22 Nov 2017 01:26:44 AM UTC, comment #2: 

Current git sources have fixed this. There will soon be a 1.0.0 release with those fixes.

Rocky Bernstein <rocky>
Group administrator
Tue 24 Oct 2017 01:50:43 AM UTC, comment #1: 

I am not seeing this behavior with ddd984854b09c1a8203867534c087c0d83ff8622

Rocky Bernstein <rocky>
Group administrator
Mon 23 Oct 2017 08:37:07 AM UTC, original submission:  

## Tested Version:
libcdio v0.94

## How reproducible:
iso-info -i $POC

## Description:
in print_iso9660_recurse function, this code
222   char translated_name = (char ) malloc(4096);
allocate 4096 buffer, the buffer was overwritten with other code and cause the crash


## Crash Information:
The output with address sanitizer enabled
./iso-info -i cdio.print_iso9660_recurse.iso-info.257.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.print_iso9660_recurse.iso-info.257.crash
System      : LINQX
Volume      : CDROM
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
=================================================================
==20217==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001c900 at pc 0x7f1c725b61e9 bp 0x7ffe0d608ab0 sp 0x7ffe0d608228
READ of size 4097 at 0x62100001c900 thread T0
    #0 0x7f1c725b61e8  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x601e8)
    #1 0x7f1c725b7145 in __interceptor_vsnprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x61145)
    #2 0x7f1c725b73b1 in snprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x613b1)
    #3 0x403276 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:257
    #4 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
    #5 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
    #6 0x7f1c721ac82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x402798 in _start (/opt/asan/bin/iso-info+0x402798)

0x62100001c900 is located 0 bytes to the right of 4096-byte region [0x62100001b900,0x62100001c900)
allocated by thread T0 here:
    #0 0x7f1c725ee602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x403019 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:222
    #2 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
    #3 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
    #4 0x7f1c721ac82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
  0x0c427fffb8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffb8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffb8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffb900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffb910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffb920:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffb930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffb940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffb950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffb960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffb970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==20217==ABORTING

gdb and backtrace
./iso-info -i cdio.print_iso9660_recurse.iso-info.257.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.print_iso9660_recurse.iso-info.257.crash
System      : LINQX
Volume      : CDROM
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
     2048 /
     2048 /a(
        0 /a(
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /00000
808464432 /0000000000000000000000000
        0 /0000000000000000000000000
        0 /0000000000000000000000000
        0 /0000000000000000000000000
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
     2048 //     2048 //a(
        0 //a(
808464432 000000000000000000000000000000000000000000000000
808464432 000000000000000000000000000000000000000000000000
808464432 000000000000000000000000000000000000000000000000
808464432 000000000000000000000000000000000000000000000000
808464432 000000000000000000000000000000000000000000000000
808464432 000000000000000000000000000000000000000000000000
808464432 00000
808464432 0000000000000000000000000
        0 0000000000000000000000000
        0 0000000000000000000000000
        0 0000000000000000000000000
++ WARN: from_733: broken byte order
++ WARN: Bad directory information for Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
Error getting above directory information
++ WARN: from_733: broken byte order
++ WARN: Bad directory information for 0000000000000000000000000
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
* Error in `/opt/normal/bin/iso-info': malloc(): memory corruption: 0x0000000000635240 *
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff7a847e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8213e)[0x7ffff7a8f13e]
/lib/x86_64-linux-gnu/libc.so.6(__libc_calloc+0xba)[0x7ffff7a91dca]
/opt/normal/bin/iso-info[0x40a767]
/opt/normal/bin/iso-info[0x40addb]
/opt/normal/bin/iso-info[0x4082f4]
/opt/normal/bin/iso-info[0x40a439]
/opt/normal/bin/iso-info[0x4025c0]
/opt/normal/bin/iso-info[0x402823]
/opt/normal/bin/iso-info[0x4020ef]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a2d830]
/opt/normal/bin/iso-info[0x402489]
======= Memory map: ========
00400000-0042c000 r-xp 00000000 08:01 1056920                            /opt/normal/bin/iso-info
0062c000-0062d000 r--p 0002c000 08:01 1056920                            /opt/normal/bin/iso-info
0062d000-0062e000 rw-p 0002d000 08:01 1056920                            /opt/normal/bin/iso-info
0062e000-00654000 rw-p 00000000 00:00 0                                  [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0
7ffff77f7000-7ffff780d000 r-xp 00000000 08:01 791595                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff780d000-7ffff7a0c000 ---p 00016000 08:01 791595                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0c000-7ffff7a0d000 rw-p 00015000 08:01 791595                     /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0d000-7ffff7bcd000 r-xp 00000000 08:01 791557                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bcd000-7ffff7dcd000 ---p 001c0000 08:01 791557                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dcd000-7ffff7dd1000 r--p 001c0000 08:01 791557                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd1000-7ffff7dd3000 rw-p 001c4000 08:01 791557                     /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd3000-7ffff7dd7000 rw-p 00000000 00:00 0
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 791529                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fb9000-7ffff7fdd000 rw-p 00000000 00:00 0
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0                          [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0                          [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 791529                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 791529                     /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0                          [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff7a4402a in __GI_abort () at abort.c:89
#2  0x00007ffff7a847ea in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffff7b9de98 "*** Error in `%s': %s: 0x%s *\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff7a8f13e in malloc_printerr (ar_ptr=0x7ffff7dd1b20 <main_arena>, ptr=0x635240, str=0x7ffff7b9acff "malloc(): memory corruption", action=<optimized out>)
    at malloc.c:5006
#4  _int_malloc (av=av@entry=0x7ffff7dd1b20 <main_arena>, bytes=bytes@entry=560) at malloc.c:3474
#5  0x00007ffff7a91dca in __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3236
#6  0x000000000040a767 in realloc_symlink (p_stat=0x6347c0, i_grow=<optimized out>) at rock.c:66
#7  0x000000000040addb in get_rock_ridge_filename (p_iso9660_dir=p_iso9660_dir@entry=0x634e51, psz_name=psz_name@entry=0x7fffffffc110 "", p_stat=p_stat@entry=0x6347c0)
    at rock.c:298
#8  0x00000000004082f4 in _iso9660_dir_to_statbuf (p_iso9660_dir=p_iso9660_dir@entry=0x634e51, b_xa=nope, u_joliet_level=<optimized out>) at iso9660_fs.c:751
#9  0x000000000040a439 in iso9660_ifs_readdir (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x6359d0 "/a(/") at iso9660_fs.c:1393
#10 0x00000000004025c0 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=0x6359d0 "/a(/") at iso-info.c:224
#11 0x0000000000402823 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x420b22 "/") at iso-info.c:300
#12 0x00000000004020ef in print_iso9660_fs (iso=0x633480) at iso-info.c:309
#13 main (argc=<optimized out>, argv=<optimized out>) at iso-info.c:501

## CREDIT
Zhao Liang, Huawei Weiran Labs

## POC file

Zhao Liang <zhao_liang>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #42234:  cdio.print_iso9660_recurse.iso-info.257.crash added by zhao_liang (50KiB - application/octet-stream - POC file that crashing catdoc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by zhao_liang (Submitted the item)
  • -email is unavailable- added by zhao_liang
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-04-13 rocky Open/ClosedOpen Closed
    2017-11-22 rocky StatusNone Fixed
        Assigned toNone rocky
    2017-10-23 zhao_liang Attached File- Added cdio.print_iso9660_recurse.iso-info.257.crash, #42234
        Carbon-Copy- Added rocky

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code