bugmake - Bugs: bug #46832, Heap buffer overflow on long...

 
 

bug #46832: Heap buffer overflow on long target lines

Submitter:  None
Submitted:  Wed 06 Jan 2016 08:41:29 PM UTC
   
 
Severity:  3 - Normal Item Group:  Bug
Status:  Fixed Privacy:  Public
Assigned to:  psmith Open/Closed:  Closed
Component Version:  None Operating System:  POSIX-Based
Fixed Release:  4.2 Triage Status:  Small Effort
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 29 Feb 2016 06:43:11 AM UTC, comment #1: 

This is because the longest string allowed in the cache was 65535 (because the length is stored in an unsigned short).  I seriously doubt that there are real makefiles out there with strings longer than that, but I added a last-ditch cache to hold arbitrarily long strings.

Fix pushed to Git.

Paul D. Smith <psmith>
Group administrator
Wed 06 Jan 2016 08:41:29 PM UTC, original submission:  

When calling Make on targets with a long line it crashes with a heap overflow.
With the latest release installed on my system (4.1) this happens with around 10.000 chars, in the git code this needs 65536 chars. Not sure if the difference is a change in git or that I compiled it differently.

Reproduce:
(echo -n "0:"; for i in $(seq 1 65536); do echo -n a; done) > Makefile
make

This is the output from address sanitizer (on the git version):
=================================================================
==22862==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000cb5f at pc 0x0000004a27e8 bp 0x7ffdca6bdc90 sp 0x7ffdca6bd440
WRITE of size 65536 at 0x60200000cb5f thread T0
    #0 0x4a27e7 in __asan_memmove (/tmp/make+0x4a27e7)
    #1 0x55b536 in copy_string /mnt/ram/make/strcache.c:80:3
    #2 0x55b536 in add_string /mnt/ram/make/strcache.c:106
    #3 0x55b536 in add_hash /mnt/ram/make/strcache.c:175
    #4 0x55b2b4 in strcache_add /mnt/ram/make/strcache.c:202:10
    #5 0x54310d in parse_file_seq /mnt/ram/make/read.c:3353:11
    #6 0x4f645e in split_prereqs /mnt/ram/make/file.c:448:21
    #7 0x54549d in record_files /mnt/ram/make/read.c:1993:18
    #8 0x53efba in eval /mnt/ram/make/read.c:1402:3
    #9 0x538676 in eval_makefile /mnt/ram/make/read.c:446:3
    #10 0x5376ec in read_all_makefiles /mnt/ram/make/read.c:263:17
    #11 0x5255ea in main /mnt/ram/make/main.c:1991:16
    #12 0x7f46f874c62f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r1/work/glibc-2.22/csu/libc-start.c:289
    #13 0x41c4e8 in _start (/tmp/make+0x41c4e8)

0x60200000cb5f is located 0 bytes to the right of 15-byte region [0x60200000cb50,0x60200000cb5f)
allocated by thread T0 here:
    #0 0x4b7b88 in malloc (/tmp/make+0x4b7b88)
    #1 0x531f54 in xmalloc /mnt/ram/make/misc.c:220:18
    #2 0x55b2b4 in strcache_add /mnt/ram/make/strcache.c:202:10
    #3 0x4f645e in split_prereqs /mnt/ram/make/file.c:448:21
    #4 0x54549d in record_files /mnt/ram/make/read.c:1993:18
    #5 0x53efba in eval /mnt/ram/make/read.c:1402:3
    #6 0x538676 in eval_makefile /mnt/ram/make/read.c:446:3
    #7 0x5376ec in read_all_makefiles /mnt/ram/make/read.c:263:17
    #8 0x5255ea in main /mnt/ram/make/main.c:1991:16
    #9 0x7f46f874c62f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r1/work/glibc-2.22/csu/libc-start.c:289

SUMMARY: AddressSanitizer: heap-buffer-overflow (/tmp/make+0x4a27e7) in __asan_memmove
Shadow bytes around the buggy address:
  0x0c047fff9910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9960: fa fa fa fa fa fa fa fa fa fa 00[07]fa fa 02 fa
  0x0c047fff9970: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa 00 02
  0x0c047fff9980: fa fa fd fd fa fa fd fd fa fa 00 00 fa fa 00 00
  0x0c047fff9990: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff99a0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff99b0: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22862==ABORTING

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #35937:  Makefile added by None (64KiB - application/octet-stream - sample Makefile triggering bug)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by psmith (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-02-29 psmith Item GroupNone Bug
        StatusNone Fixed
        Assigned toNone psmith
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.2
        Triage StatusNone Small Effort
    2016-01-06 None Attached File- Added Makefile, #35937

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code