bugGNU Screen - Bugs: bug #57937, Heap Buffer overflow in MWrapChar

 
 

bug #57937: Heap Buffer overflow in MWrapChar

Submitter:  Hanno Boeck <hanno>
Submitted:  Mon 02 Mar 2020 12:01:51 PM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  * 5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release:  None
Fixed Release:  None Planned Release:  None
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 04 Feb 2022 03:32:42 PM UTC, comment #3: 

And let me remark that I find this seriously worrying that while trying to repro one memory safety bug I just happen to step over another.

On a more meta-level I thik you should add some form of regular asan-based testing to your development process.

 Hanno Boeck <hanno>
Fri 04 Feb 2022 03:24:05 PM UTC, comment #2: 

I am no longer able to reproduce that bug, because apparently when I try I'm hitting a different bug that crashes screen with asan:

==10017==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6160013ceec4 at pc 0x7fd1e224ea47 bp 0x7ffc8ca84430 sp 0x7ffc8ca83bd8
READ of size 584 at 0x6160013ceec4 thread T0
    #0 0x7fd1e224ea46 in __interceptor_memmove (/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.1/libasan.so.6+0x39a46)
    #1 0x55fbfe37946f in MScrollV (/tmp/s/screen/src/screen+0x5446f)
    #2 0x55fbfe371661 in LineFeed (/tmp/s/screen/src/screen+0x4c661)
    #3 0x55fbfe36a661 in Special (/tmp/s/screen/src/screen+0x45661)
    #4 0x55fbfe366e9c in WriteString (/tmp/s/screen/src/screen+0x41e9c)
    #5 0x55fbfe470feb in win_readev_fn (/tmp/s/screen/src/screen+0x14bfeb)
    #6 0x55fbfe443343 in sched (/tmp/s/screen/src/screen+0x11e343)
    #7 0x55fbfe3579d0 in main (/tmp/s/screen/src/screen+0x329d0)
    #8 0x7fd1e1ffb2f9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #9 0x7fd1e1ffb3a7 in __libc_start_main_impl ../csu/libc-start.c:409
    #10 0x55fbfe352b60 in _start (/tmp/s/screen/src/screen+0x2db60)

0x6160013ceec4 is located 0 bytes to the right of 580-byte region [0x6160013cec80,0x6160013ceec4)
allocated by thread T0 here:
    #0 0x7fd1e22c7bc8 in __interceptor_realloc (/usr/lib/gcc/x86_64-pc-linux-gnu/11.2.1/libasan.so.6+0xb2bc8)
    #1 0x55fbfe43e480 in xrealloc (/tmp/s/screen/src/screen+0x119480)
    #2 0x55fbfe43d2ec in CheckMaxSize (/tmp/s/screen/src/screen+0x1182ec)
    #3 0x55fbfe43a215 in ChangeScreenSize (/tmp/s/screen/src/screen+0x115215)
    #4 0x55fbfe439a70 in CheckScreenSize (/tmp/s/screen/src/screen+0x114a70)
    #5 0x55fbfe44da18 in ReceiveMsg (/tmp/s/screen/src/screen+0x128a18)
    #6 0x55fbfe35b8bf in serv_read_fn (/tmp/s/screen/src/screen+0x368bf)
    #7 0x55fbfe443343 in sched (/tmp/s/screen/src/screen+0x11e343)
    #8 0x55fbfe3579d0 in main (/tmp/s/screen/src/screen+0x329d0)
    #9 0x7fd1e1ffb2f9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Hanno Boeck <hanno>
Thu 03 Feb 2022 12:21:03 AM UTC, comment #1: 

Ah, again this macro...
Try this:


diff --git a/src/ansi.c b/src/ansi.c
index 27983bb..f0d7b73 100644
--- a/src/ansi.c
+++ b/src/ansi.c
@@ -2451,11 +2451,12 @@ struct mchar *mc;
     }

 # define MKillDwLeft(p, ml, x)                                 \
+  if (x + 1 < p->w_width) {                                            \
   if (dw_left(ml, x, p->w_encoding))                           \
     {                                                          \
       copy_mchar2mline(&mchar_blank, ml, x);                   \
       copy_mchar2mline(&mchar_blank, ml, x + 1);               \
-    }
+    }}
 #else
 # define MKillDwRight(p, ml, x) ;
 # define MKillDwLeft(p, ml, x) ;
@@ -2781,7 +2782,7 @@ int ins;
 #endif
   MFixLine(p, y, c);
   ml = &p->w_mlines[y];
-  copy_mchar2mline(&mchar_null, ml, p->w_width);
+  copy_mchar2mline(&mchar_null, ml, p->w_width - 1);
   if (y == bot)
     MScrollV(p, 1, top, bot, bce);
   else if (y < p->w_height - 1)


 Alexander Naumov <anaumov>
Group administrator
Mon 02 Mar 2020 12:01:51 PM UTC, original submission:  

With an ASAN-compiled screen I observed a heap overflow.

This seems to happen if there is some output of the screen and the window is resized. I was able to reproduce this by doing a cat /dev/urandom within a screen in a GUI terminal and then resizing the window for a while in random movement.

ASAN detects a 1 byte heap overflow in MWrapChar, log attached.

 Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #48531:  screen-asan.txt added by hanno (3KiB - text/plain - asan stack trace)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by anaumov (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-03-02 hanno Attached File- Added screen-asan.txt, #48531

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-397b.
    Corresponding source code