helpThe GNU Bourne-Again SHell - Support: sr #108885, 4-byte script triggers null ptr...

 
 

sr #108885: 4-byte script triggers null ptr deref and segfault

Submitted by:  Brian Carpenter <geeknik>
Submitted on:  Thu 17 Sep 2015 04:47:40 PM UTC  
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 17 Sep 2015 05:52:23 PM UTC, comment #1:

bash -c '!; &' since the hexdump output was mangled by the bug tracker.

Brian Carpenter <geeknik>
Thu 17 Sep 2015 04:47:40 PM UTC, original submission:

While fuzzing GNU bash version 4.3.42(1)-release (x86_64-unknown-linux-gnu) with AFL(http://lcamtuf.coredump.cx/afl), I stumbled upon a 4-byte 'script' that triggers a null ptr deref and causes a segfault.

OS: Debian 7 (3.2.68-1+deb7u3 x86_64)
libc: 2.13-38+deb7u8
gcc: 4.92

Script: Attached
Hexdump:

              1. 3b21 2620

0000004

Valgrind:
==9729== Invalid read of size 1
==9729== at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729== by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729== by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729== by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729== by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729== by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729== by 0x42E41F: reader_loop (eval.c:160)
==9729== by 0x426566: main (shell.c:756)
==9729== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==9729==
==9729==
==9729== Process terminating with default action of signal 11 (SIGSEGV)
==9729== Access not within mapped region at address 0x0
==9729== at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729== by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729== by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729== by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729== by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729== by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729== by 0x42E41F: reader_loop (eval.c:160)
==9729== by 0x426566: main (shell.c:756)
==9729== If you believe this happened as a result of a stack
==9729== overflow in your program's main thread (unlikely but
==9729== possible), you can try to increase the size of the
==9729== main thread stack using the --main-stacksize= flag.
==9729== The main thread stack size used in this run was 8388608.
Segmentation fault

GDB:
Program received signal SIGSEGV, Segmentation fault.
__strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
32 ../sysdeps/x86_64/multiarch/strlen-sse4.S: No such file or directory.
(gdb) bt
#0 __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1 0x000000000049fa70 in execute_simple_command () at execute_cmd.c:3944
#2 0x00000000004aabd8 in execute_command_internal () at execute_cmd.c:787
#3 0x00000000004af1a3 in execute_command_internal () at execute_cmd.c:2466
#4 0x00000000004b2c7d in execute_command () at execute_cmd.c:390
#5 0x000000000042e420 in reader_loop ()
#6 0x0000000000426567 in main () at shell.c:756
(gdb) i r
rax 0x0 0
rbx 0x0 0
rcx 0x0 0
rdx 0x1 1
rsi 0xffffff00 4294967040
rdi 0x0 0
rbp 0x0 0x0
rsp 0x7fffffffde68 0x7fffffffde68
r8 0x0 0
r9 0x0 0
r10 0x0 0
r11 0x1 1
r12 0xac8bc8 11307976
r13 0xac8c88 11308168
r14 0x0 0
r15 0x0 0
rip 0x7ffff773f8cf 0x7ffff773f8cf <__strlen_sse42+15>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0

Brian Carpenter <geeknik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #34910:  test00 added by geeknik (4B - application/octet-stream - Testcase)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Updated the item)
  • -email is unavailable- added by geeknik (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-13 chet StatusNone => Done
    2015-09-17 geeknik Attached File- => Added test00, #34910

    Back to the top


    Powered by Savane 3.3