bugGNU cflow - Bugs: bug #61291, heap-buffer-overflow in cflow at...

 
 

bug #61291: heap-buffer-overflow in cflow at src/symbol.c:302

Submitter:  Irfan Ariq <irfanariq>
Submitted:  Tue 05 Oct 2021 05:32:28 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 05 Oct 2021 05:32:28 PM UTC, original submission:  

Hello,

We are currently working on fuzz testing feature, and we found a *heap-buffer-overflow* on `cflow`.

The stack traces are as follow:
```st
==2630==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000990 at pc 0x5597a75897d7 bp 0x7ffe5e3a5b20 sp 0x7ffe5e3a5b10
WRITE of size 8 at 0x619000000990 thread T0
    #0 0x5597a75897d6 in collect_processor .../cflow-1.6/src/symbol.c:302
    #1 0x5597a759fa38 in hash_do_for_each .../cflow-1.6/gnu/hash.c:383
    #2 0x5597a7589af1 in collect_symbols .../cflow-1.6/src/symbol.c:334
    #3 0x5597a757fbde in tree_output .../cflow-1.6/src/output.c:383
    #4 0x5597a75802ce in output .../cflow-1.6/src/output.c:435
    #5 0x5597a757db93 in main .../cflow-1.6/src/main.c:829
```
The full stack trace is attached.

*Step to reproduce*

We configured `cflow` using `CFLAGS="-g -O0 -fsanitize=address" ./configure --disable-shared` and build it using `make -j10; make install`, and run it with:

```
./cflow <attached file> --number --include=x -n -o /dev/null
```

The input file is attached.

*Environment*
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- cflow version: [cflow 1.6](https://ftp.gnu.org/gnu/cflow/cflow-1.6.tar.xz)

Thank you.

Irfan Ariq <irfanariq>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #52038:  full_stacktrace_poc_4.zip added by irfanariq (1KiB - application/x-zip-compressed)
file #52039:  input_cflow_poc_4.zip added by irfanariq (3KiB - application/x-zip-compressed)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by irfanariq (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-05 irfanariq Attached File- Added full_stacktrace_poc_4.zip, #52038
        Attached File- Added input_cflow_poc_4.zip, #52039

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code