bugGNU Screen - Bugs: bug #53173, Out of bounds heap memory read in...

 
 

bug #53173: Out of bounds heap memory read in MClearArea()

Submitted by:  None
Submitted on:  Fri 16 Feb 2018 09:58:10 PM UTC  
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release:  4.6.2
Fixed Release:  None Planned Release:  None
Work Required:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 04 Mar 2018 11:16:06 AM UTC, comment #1:

attached preliminary fix, but would like to spend some more time looking into it, particularly the macro one seems like it may cause some problems, although I didn't see any in my testing

(file #43458)

Amadeusz Sławiński <amade>
Project Administrator
Fri 16 Feb 2018 09:58:10 PM UTC, original submission:

I detected an out of bounds heap read in screen when building with address sanitizer. Happens both in 4.6.2 and current git, though the code changed a bit, so the line numbers differ. I'll attach stack traces for both.

This can be reliably reproduced for me by:
1. compile screen with -fsanitize=address in CFLAGS+LDFLAGS.
2. run screen in a terminal emulator.
3. Press ctrl-a.
4. Resize the window.

Screen will hang and the main process will have crashed with an oob read in MClearArea.

Stack trace:
==19786==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000001154 at pc 0x561d8c848842 bp 0x7ffdea718400 sp 0x7ffdea7183f0
READ of size 4 at 0x615000001154 thread T0
#0 0x561d8c848841 in MClearArea /mnt/ram/screen/src/ansi.c:2117
#1 0x561d8c8411ab in ClearLineRegion /mnt/ram/screen/src/ansi.c:1636
#2 0x561d8c8390a8 in DoCSI /mnt/ram/screen/src/ansi.c:887
#3 0x561d8c834085 in WriteString /mnt/ram/screen/src/ansi.c:426
#4 0x561d8c937335 in win_readev_fn /mnt/ram/screen/src/window.c:1443
#5 0x561d8c90ae42 in sched /mnt/ram/screen/src/sched.c:164
#6 0x561d8c8250f9 in main /mnt/ram/screen/src/screen.c:1075
#7 0x7f33026c8f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)
#8 0x561d8c8204a9 in _start (/mnt/ram/screen/src/screen+0x294a9)

0x615000001154 is located 0 bytes to the right of 468-byte region [0x615000000f80,0x615000001154)
allocated by thread T0 here:
#0 0x7f33033ff220 in realloc (/usr/lib/gcc/x86_64-pc-linux-gnu/7.3.0/libasan.so.4+0xe1220)
#1 0x561d8c90640d in xrealloc /mnt/ram/screen/src/resize.c:455
#2 0x561d8c90503f in CheckMaxSize /mnt/ram/screen/src/resize.c:394
#3 0x561d8c901cb1 in ChangeScreenSize /mnt/ram/screen/src/resize.c:128
#4 0x561d8c901518 in CheckScreenSize /mnt/ram/screen/src/resize.c:100
#5 0x561d8c9150f0 in ReceiveMsg /mnt/ram/screen/src/socket.c:813
#6 0x561d8c828ee7 in serv_read_fn /mnt/ram/screen/src/screen.c:1627
#7 0x561d8c90ae42 in sched /mnt/ram/screen/src/sched.c:164
#8 0x561d8c8250f9 in main /mnt/ram/screen/src/screen.c:1075
#9 0x7f33026c8f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #43335:  screen-asan-oob-4.6.2.txt added by None (3KiB - text/plain - full asan errors)
file #43336:  screen-asan-oob-git.txt added by None (3KiB - text/plain - full asan errors)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by amade (Updated the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-03-04 amade Attached File- => Added 0001-fix-out-of-bound-accesses.patch, #43458
    2018-02-16 None Attached File- => Added screen-asan-oob-4.6.2.txt, #43335
        Attached File- => Added screen-asan-oob-git.txt, #43336

    Back to the top


    Powered by Savane 3.3