bugmake - Bugs: bug #45049, Invalid read / heap overflow in...

 
 

bug #45049: Invalid read / heap overflow in function parse_variable_definition()

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Thu 07 May 2015 10:10:49 PM UTC  
 
Severity: 3 - NormalItem Group: None
Status: FixedPrivacy: Public
Assigned to: Paul D. Smith <psmith>Open/Closed: Closed
Component Version: 4.1Operating System: None
Fixed Release: 4.2Triage Status: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 13 Jul 2015 04:15:25 AM UTC, comment #1:

I pushed a fix for this to Git. Thanks for the report!

Paul D. Smith <psmith>
Project AdministratorIn charge of this item.
Thu 07 May 2015 10:10:49 PM UTC, original submission:

Attached sample file (which is just a $ character) will cause an invalid read / heap overflow in make.

This can be seen with either address sanitizer or valgrind. I've attached full address sanitizer output.

This was found with the tool american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by psmith (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 13 Jul 2015 04:15:25 AM UTCpsmithStatusNone=>Fixed
      Assigned toNone=>psmith
      Open/ClosedOpen=>Closed
      Component VersionNone=>4.1
      Fixed ReleaseNone=>4.2
    Thu 07 May 2015 10:10:49 PM UTChannoAttached File-=>Added Makefile.heapoverflow-parse_variable_definition, #33958
      Attached File-=>Added Makefile.heapoverflow-parse_variable_definition.asan.txt, #33959

    Back to the top


    Powered by Savane 3.1-cleanup1