bugunrtf - Bugs: bug #44650, parsing config file with zero byte...

 
 

bug #44650: parsing config file with zero byte creates invalid memory access

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Fri 27 Mar 2015 12:47:16 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Jean-Francois Dockes <medoc>Open/Closed: Closed
Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 12 Jun 2015 05:52:33 AM UTC, comment #1:

OOps, this was (hopefully) fixed 2 months ago by:

http://hg.savannah.gnu.org/hgweb/unrtf/rev/e79d1d2407ac

Forgot to close the issue, doing it.

Jean-Francois Dockes <medoc>
Project AdministratorIn charge of this item.
Fri 27 Mar 2015 12:47:16 PM UTC, original submission:

When the unrtf output config contains a zero byte with a following newline this creates an invalid memory read access / stack buffer underflow in unrtf.

  • Reproduce:

Compile and build unrtf with address sanitizer:
./bootstrap; ./configure CFLAGS="-fsanitize=address"; make
Replace html output conf with zero byte + newline:
echo -e '\x00' > outputs/html.conf
Run unrtf with that file:
src/unrtf -P outputs/

(It may be argued that this is not a real issue because malformed config files are unexpected, but I'd say to be safe all parser code should be able to handle malformed input in a sane way)

I'll attach the address sanitizer output and the malformed input file. (Issue found with american fuzzy lop.)

Relevant part of Address Sanitizer output:
==15660==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd94c2dc3f at pc 0x41d457 bp 0x7ffd94c2dbf0 sp 0x7ffd94c2dbe0
READ of size 1 at 0x7ffd94c2dc3f thread T0
#0 0x41d456 in user_init (/tmp/unrtf-0.21.9/src/unrtf+0x41d456)
#1 0x414084 in get_config (/tmp/unrtf-0.21.9/src/unrtf+0x414084)
#2 0x414b79 in main (/tmp/unrtf-0.21.9/src/unrtf+0x414b79)
#3 0x7fba3af50f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
#4 0x401bd8 (/tmp/unrtf-0.21.9/src/unrtf+0x401bd8)

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #33467:  html.conf added by hanno (2B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by medoc (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 12 Jun 2015 05:53:12 AM UTCmedocOpen/ClosedOpen=>Closed
    Fri 12 Jun 2015 05:52:33 AM UTCmedocStatusNone=>Fixed
      Assigned toNone=>medoc
    Fri 27 Mar 2015 12:47:16 PM UTChannoAttached File-=>Added unrtf-malformed-output-conf.asan.log, #33466
      Attached File-=>Added html.conf, #33467

    Back to the top


    Powered by Savane 3.1-cleanup1