bugGNU cflow - Bugs: bug #61250, heap-buffer-overflow in cflow at...

 
 

bug #61250: heap-buffer-overflow in cflow at src/c.l:308

Submitter:  Irfan Ariq <irfanariq>
Submitted:  Thu 30 Sep 2021 08:00:37 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 30 Sep 2021 08:00:37 PM UTC, original submission:  

Hello,

We are currently working on fuzz testing feature, and we found a heap-buffer-overflow on `cflow`.

The stack traces are as follow:
```st
==29255==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6210000038e0 at pc 0x7f38f7b8a66e bp 0x7ffee4601140 sp 0x7ffee46008e8
READ of size 4049 at 0x6210000038e0 thread T0
    #0 0x7f38f7b8a66d  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d)
    #1 0x55a3538156a4 in xstrdup .../cflow-1.6/gnu/xmalloc.c:123
    #2 0x55a3537e9878 in pp_finalize .../cflow-1.6/src/c.l:308
    #3 0x55a3537e9a12 in pp_open .../cflow-1.6/src/c.l:326
    #4 0x55a3537e9e51 in source .../cflow-1.6/src/c.l:400
    #5 0x55a3537eea14 in main .../cflow-1.6/src/main.c:811
```
The full stack trace is attached.

Step to reproduce

We configured `cflow` using `CFLAGS="-g -O0 -fsanitize=address" ./configure --disable-shared` and built in using `make -j10; make install`, and run it with:

```
./cflow 24 3 <attched file> 123 _ -l cflow -a -b -I t -D --debug --emacs -v -v -m -x --omit-symbol-names
```
The input file is attached.

Environment
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- cflow version: [cflow 1.6](https://ftp.gnu.org/gnu/cflow/cflow-1.6.tar.xz)

Thank you.

Irfan Ariq <irfanariq>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #51990:  full_stacktrace_poc2.zip added by irfanariq (1KiB - application/x-zip-compressed)
file #51991:  input_cflow_poc_2.zip added by irfanariq (1KiB - application/x-zip-compressed)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by irfanariq (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-09-30 irfanariq Attached File- Added full_stacktrace_poc2.zip, #51990
        Attached File- Added input_cflow_poc_2.zip, #51991

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code