bugGNU cflow - Bugs: bug #61292, use-after-free in cflow at...

 
 

bug #61292: use-after-free in cflow at src/parser.c:1284

Submitter:  Irfan Ariq <irfanariq>
Submitted:  Tue 05 Oct 2021 05:33:53 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 05 Oct 2021 05:33:53 PM UTC, original submission:  

Hello,

We are currently working on fuzz testing feature, and we found a *heap-buffer-overflow* on `cflow`.

The stack traces are as follow:
```st
==3576==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e0000031d0 at pc 0x55f59aaf6c6e bp 0x7ffd06c1c250 sp 0x7ffd06c1c240
READ of size 8 at 0x60e0000031d0 thread T0
    #0 0x55f59aaf6c6d in call .../cflow-1.6/src/parser.c:1284
    #1 0x55f59aaf3adb in expression .../cflow-1.6/src/parser.c:618
    #2 0x55f59aaf5336 in func_body .../cflow-1.6/src/parser.c:1051
    #3 0x55f59aaf430d in parse_variable_declaration .../cflow-1.6/src/parser.c:781
    #4 0x55f59aaf53f0 in func_body .../cflow-1.6/src/parser.c:1061
    #5 0x55f59aaf430d in parse_variable_declaration .../cflow-1.6/src/parser.c:781
    #6 0x55f59aaf53f0 in func_body .../cflow-1.6/src/parser.c:1061
    #7 0x55f59aaf430d in parse_variable_declaration .../cflow-1.6/src/parser.c:781
    #8 0x55f59aaf53f0 in func_body .../cflow-1.6/src/parser.c:1061
    #9 0x55f59aaf430d in parse_variable_declaration .../cflow-1.6/src/parser.c:781
    #10 0x55f59aaf5398 in func_body .../cflow-1.6/src/parser.c:1056
```
The full stack trace is attached.

*Step to reproduce*

We configured `cflow` using `CFLAGS="-g -O0 -fsanitize=address" ./configure --disable-shared` and build it using `make -j10; make install`, and run it with:

```
./cflow <attached file>
```

The input file is attached.

*Environment*
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- cflow version: [cflow 1.6](https://ftp.gnu.org/gnu/cflow/cflow-1.6.tar.xz)

Thank you.

Irfan Ariq <irfanariq>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #52040:  full_stacktrace_poc_5.zip added by irfanariq (2KiB - application/x-zip-compressed)
file #52041:  input_cflow_poc_5.zip added by irfanariq (4KiB - application/x-zip-compressed)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by irfanariq (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-10-05 irfanariq Attached File- Added full_stacktrace_poc_5.zip, #52040
        Attached File- Added input_cflow_poc_5.zip, #52041

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code