Thu 29 Jan 2015 01:05:54 AM UTC, original submission:
I'm fuzzing cflow with american fuzzy lop (http://lcamtuf.coredump.cx/afl/). I compiled the app using afl-gcc like so:
CC=/path/to/afl-gcc ./configure
AFL_HARDEN=1 make
Here is the valgrind and gdb output:
=8312== Invalid read of size 8
==8312== at 0x43142A: expression (parser.c:1154)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid write of size 8
==8312== at 0x41D604: linked_list_append (linked-list.c:28)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x43410C: maybe_parm_list (parser.c:434)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x431A1A: expression (parser.c:1140)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x431B55: expression (parser.c:1141)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x431A1A: expression (parser.c:1140)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x431B55: expression (parser.c:1141)
==8312== by 0x43A16E: parse_variable_declaration (parser.c:636)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x43142A: expression (parser.c:1154)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
==8312== Invalid read of size 8
==8312== at 0x41D42E: linked_list_append (linked-list.c:24)
==8312== by 0x43148D: expression (parser.c:1155)
==8312== by 0x432A2E: func_body (parser.c:909)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312== Address 0x51c91b0 is 144 bytes inside a block of size 152 free'd
==8312== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==8312== by 0x4401B0: delete_level_autos (symbol.c:206)
==8312== by 0x41DDC4: linked_list_iterate (linked-list.c:130)
==8312== by 0x4425A3: delete_autos (symbol.c:276)
==8312== by 0x432D8A: func_body (parser.c:941)
==8312== by 0x434AB4: maybe_parm_list (parser.c:432)
==8312== by 0x43507F: dirdcl (parser.c:804)
==8312== by 0x439AAE: parse_variable_declaration (parser.c:734)
==8312== by 0x432C09: func_body (parser.c:919)
==8312== by 0x43B8D4: yyparse (parser.c:432)
==8312== by 0x402DA4: main (main.c:796)
==8312==
rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (R):
malloc()
size()
rpermutF() <ins *rpermutF (int n) at id:000000,sig:11,src:000001,op:havoc,rep:16:2> (recursive: see 1)
rand()
warning: Can't read pathname for load map: Input/output error.
Core was generated by `/home/geeknik/cflow-1.4/src/cflow id:000000,sig:11,src:000001,op:havoc,rep:16'.
Program terminated with signal 11, Segmentation fault.
#0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
144 for (p = linked_list_head(list); p; p = p->next)
(gdb) bt
#0 0x000000000041e2c0 in data_in_list (data=0x69aff0, list=0x20) at linked-list.c:144
#1 0x0000000000431436 in reference (line=<optimized out>, name=<optimized out>) at parser.c:1154
#2 expression () at parser.c:475
#3 0x000000000043a16f in parse_variable_declaration (ident=ident@entry=0x7fffffffe080, parm=parm@entry=1) at parser.c:636
#4 0x000000000043410d in parse_declaration (parm=1, ident=0x7fffffffe080) at parser.c:434
#5 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe13c) at parser.c:873
#6 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:804
#7 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe130) at parser.c:771
#8 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe130) at parser.c:734
#9 parse_variable_declaration (ident=ident@entry=0x7fffffffe130, parm=parm@entry=0) at parser.c:610
#10 0x0000000000432c0a in func_body () at parser.c:919
#11 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#12 0x0000000000434ab5 in parse_declaration (parm=1, ident=0x7fffffffe160) at parser.c:432
#13 maybe_parm_list (parm_cnt_return=parm_cnt_return@entry=0x7fffffffe21c) at parser.c:873
#14 0x0000000000435080 in dirdcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:804
#15 0x00000000004373d6 in dcl (idptr=idptr@entry=0x7fffffffe210) at parser.c:771
#16 0x0000000000439aaf in parse_dcl (maybe_knr=0, ident=0x7fffffffe210) at parser.c:734
#17 parse_variable_declaration (ident=ident@entry=0x7fffffffe210, parm=parm@entry=0) at parser.c:610
#18 0x0000000000432c0a in func_body () at parser.c:919
#19 0x0000000000433a77 in parse_function_declaration (ident=<optimized out>, parm=<optimized out>) at parser.c:531
#20 0x000000000043b8d5 in parse_declaration (parm=0, ident=0x7fffffffe240) at parser.c:432
#21 yyparse () at parser.c:385
#22 0x0000000000402da5 in main (argc=2, argv=0x7fffffffe378) at main.c:796
#23 0x00007ffff7a6fead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>,
---Type <return> to continue, or q <return> to quit---
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe368) at libc-start.c:244
#24 0x0000000000402ed9 in _start ()
(gdb) i r
rax 0x0 0
rbx 0x0 0
rcx 0x69b920 6928672
rdx 0x69b930 6928688
rsi 0x20 32
rdi 0x69aff0 6926320
rbp 0x69aff0 0x69aff0
rsp 0x7fffffffdff0 0x7fffffffdff0
r8 0x69b920 6928672
r9 0x10 16
r10 0xc 12
r11 0xb 11
r12 0x1a 26
r13 0x48 72
r14 0x0 0
r15 0x0 0
rip 0x41e2c0 0x41e2c0 <data_in_list+88>
eflags 0x10202 [ IF RF ]
cs 0x33 51
ss 0x2b 43
ds 0x0 0
es 0x0 0
fs 0x0 0
gs 0x0 0
I've attached the test case and the core dump.
|