bugThe oSIP library - Bugs: bug #56071, [Bug report] Heap-buffer-overflow...

 
 

bug #56071: [Bug report] Heap-buffer-overflow in osip_util_replace_all_lws function in osip_message_parse.c, in libosip2-5.1.0

Submitter:  wcventure <wcventure>
Submitted:  Thu 04 Apr 2019 05:39:00 AM UTC
   
 
Category:  None Severity:  4 - Important
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  aymeric
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 13 Jan 2020 01:34:06 PM UTC, comment #2: 

-- previous commit b0ad172292e7f89528bd79fa41015c8184fd485e is broken --

Real fix is available:

http://git.savannah.gnu.org/cgit/osip.git/commit/?id=523447075265123e040ce057425169616ce7df8c


Aymeric MOIZARD <aymeric>
Group administrator
Mon 13 Jan 2020 11:21:46 AM UTC, comment #1: 

-again, I received no notification for this bug report: sorry for the delay in the answer-

I have fixed the issue:

http://git.savannah.gnu.org/cgit/osip.git/commit/?id=b0ad172292e7f89528bd79fa41015c8184fd485e

Thanks a lot for the report.
Aymeric

Aymeric MOIZARD <aymeric>
Group administrator
Thu 04 Apr 2019 05:39:00 AM UTC, original submission:  

Hi there,

I have found heap-buffer-overflow in osip_util_replace_all_lws function in osip_message_parse.c, in libosip2-5.1.0 the lastest release version. A crafted input can cause segment faults and I have confirmed them with address sanitizer too.

Here are the POC files. Please use the "/src/test/torture_test $POC" to reproduce the bug.

The ASAN dumps the stack trace as follows:

> ==159351==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000011e at pc 0x0000005271a5 bp 0x7ffd601727d0 sp 0x7ffd601727c8
> READ of size 1 at 0x60600000011e thread T0
>     #0 0x5271a4 in osip_util_replace_all_lws /libosip2-5.1.0/src/osipparser2/osip_message_parse.c:297:21
>     #1 0x5271a4 in _osip_message_parse /libosip2-5.1.0/src/osipparser2/osip_message_parse.c:810
>     #2 0x513410 in test_message /libosip2-5.1.0/src/test/torture.c:131:5
>     #3 0x512e13 in main /libosip2-5.1.0/src/test/torture.c:100:13
>     #4 0x7f8bd257682f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
>     #5 0x41a218 in _start (/libosip2-5.1.0/src/test/torture_test+0x41a218)
>
> 0x60600000011e is located 0 bytes to the right of 62-byte region [0x6060000000e0,0x60600000011e)
> allocated by thread T0 here:
>     #0 0x4da140 in __interceptor_malloc /llvm-6.0.1/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88
>     #1 0x5222bc in _osip_message_parse /libosip2-5.1.0/src/osipparser2/osip_message_parse.c:800:9
>     #2 0x513410 in test_message /libosip2-5.1.0/src/test/torture.c:131:5
>     #3 0x512e13 in main /libosip2-5.1.0/src/test/torture.c:100:13
>
> SUMMARY: AddressSanitizer: heap-buffer-overflow /libosip2-5.1.0/src/osipparser2/osip_message_parse.c:297:21 in osip_util_replace_all_lws
> Shadow bytes around the buggy address:
>   0x0c0c7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>   0x0c0c7fff8000: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
>   0x0c0c7fff8010: 00 00 00 00 00 00 00 03 fa fa fa fa 00 00 00 00
> =>0x0c0c7fff8020: 00 00 00[06]fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c0c7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c0c7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c0c7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==159351==ABORTING

wcventure <wcventure>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #46717:  POC1 added by wcventure (105B - application/octet-stream - POC)
file #46718:  POC2 added by wcventure (27B - application/octet-stream - POC)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by aymeric (Posted a comment)
  • -email is unavailable- added by wcventure (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-01-13 aymeric Assigned toNone aymeric
    2020-01-13 aymeric Severity3 - Normal 4 - Important
        StatusNone Fixed
        Open/ClosedOpen Closed
    2019-04-04 wcventure Attached File- Added POC1, #46717
        Attached File- Added POC2, #46718

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code