mainThe GNU Bourne-Again SHell - Support: sr #108885, 4-byte script triggers null ptr...

 
 

sr #108885: 4-byte script triggers null ptr deref and segfault

Submitter:  Brian Carpenter <geeknik>
Submitted:  Thu 17 Sep 2015 04:47:40 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 17 Sep 2015 05:52:23 PM UTC, comment #1: 

bash -c '!; &' since the hexdump output was mangled by the bug tracker.

Brian Carpenter <geeknik>
Thu 17 Sep 2015 04:47:40 PM UTC, original submission:  

While fuzzing GNU bash version 4.3.42(1)-release (x86_64-unknown-linux-gnu) with AFL(http://lcamtuf.coredump.cx/afl), I stumbled upon a 4-byte 'script' that triggers a null ptr deref and causes a segfault.

OS: Debian 7 (3.2.68-1+deb7u3 x86_64)
libc: 2.13-38+deb7u8
gcc: 4.92

Script: Attached
Hexdump:
0000000 3b21 2620                             
0000004

Valgrind:
==9729== Invalid read of size 1
==9729==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729==    by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729==    by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729==    by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729==    by 0x42E41F: reader_loop (eval.c:160)
==9729==    by 0x426566: main (shell.c:756)
==9729==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==9729==
==9729==
==9729== Process terminating with default action of signal 11 (SIGSEGV)
==9729==  Access not within mapped region at address 0x0
==9729==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==9729==    by 0x49FA6F: execute_simple_command (execute_cmd.c:3944)
==9729==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==9729==    by 0x4AF1A2: execute_connection (execute_cmd.c:2466)
==9729==    by 0x4AF1A2: execute_command_internal (execute_cmd.c:945)
==9729==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==9729==    by 0x42E41F: reader_loop (eval.c:160)
==9729==    by 0x426566: main (shell.c:756)
==9729==  If you believe this happened as a result of a stack
==9729==  overflow in your program's main thread (unlikely but
==9729==  possible), you can try to increase the size of the
==9729==  main thread stack using the --main-stacksize= flag.
==9729==  The main thread stack size used in this run was 8388608.
Segmentation fault

GDB:
Program received signal SIGSEGV, Segmentation fault.
__strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
32 ../sysdeps/x86_64/multiarch/strlen-sse4.S: No such file or directory.
(gdb) bt
#0  __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1  0x000000000049fa70 in execute_simple_command () at execute_cmd.c:3944
#2  0x00000000004aabd8 in execute_command_internal () at execute_cmd.c:787
#3  0x00000000004af1a3 in execute_command_internal () at execute_cmd.c:2466
#4  0x00000000004b2c7d in execute_command () at execute_cmd.c:390
#5  0x000000000042e420 in reader_loop ()
#6  0x0000000000426567 in main () at shell.c:756
(gdb) i r
rax            0x0 0
rbx            0x0 0
rcx            0x0 0
rdx            0x1 1
rsi            0xffffff00 4294967040
rdi            0x0 0
rbp            0x0 0x0
rsp            0x7fffffffde68 0x7fffffffde68
r8             0x0 0
r9             0x0 0
r10            0x0 0
r11            0x1 1
r12            0xac8bc8 11307976
r13            0xac8c88 11308168
r14            0x0 0
r15            0x0 0
rip            0x7ffff773f8cf 0x7ffff773f8cf <__strlen_sse42+15>
eflags         0x10246 [ PF ZF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0

Brian Carpenter <geeknik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #34910:  test00 added by geeknik (4B - application/octet-stream - Testcase)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Updated the item)
  • -email is unavailable- added by geeknik (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-13 chet StatusNone Done
    2015-09-17 geeknik Attached File- Added test00, #34910

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code