bugGNU gettext - Bugs: bug #45391, Out of bounds read in xgettext on...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45391: Out of bounds read in xgettext on malformed input

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Wed 24 Jun 2015 01:17:28 PM UTC  
 
Category: Programmer toolsSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Daiki Ueno <ueno>
Open/Closed: Closed

(Jump to the original submission Jump to the original submission)

Fri 26 Jun 2015 02:54:02 AM UTC, comment #7:

Thanks for confirming.

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Thu 25 Jun 2015 03:11:16 PM UTC, comment #6:

yes, fixed now, you can close the bug

Hanno Boeck <hanno>
Thu 25 Jun 2015 12:05:47 PM UTC, comment #5:

Ugh, the fix was immature. I think it should be fixed now with:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=11ad7fcdb858c83d7aed5245761f2bc6f856980d

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Thu 25 Jun 2015 09:06:34 AM UTC, comment #4:

I still get the same error on the second input. (file content 'gettext("\x').

Hanno Boeck <hanno>
Thu 25 Jun 2015 02:50:19 AM UTC, comment #3:

Right, thanks for your carefulness.

I've simplified the loop invariant to work out possible variants:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=4dd7d3dbcb2ec6ceae3a65d405751729fd26e1e1

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Wed 24 Jun 2015 02:51:42 PM UTC, comment #2:

It fixes the first input, but a small variant of it still causes an oob, see attachment. Instead of a zero byte and a newline it has an x after the \:
gettext("\x

(file #34306)

Hanno Boeck <hanno>
Wed 24 Jun 2015 02:30:38 PM UTC, comment #1:

Thanks for the report. I've committed a fix:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=8d235255

I think this is enough since gettext doesn't accept NUL character in translatable strings, but let me know if it is not the case.

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Wed 24 Jun 2015 01:17:28 PM UTC, original submission:

The attached file will cause an out of bounds heap read access in xgettext. Found with american fuzzy lop. This can be detected with either address sanitizer or valgrind.

Address Sanitizer trace:
```
==29054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000c6b2 at pc 0x0000004fad7e bp 0x7fff2b6eb190 sp 0x7fff2b6eb188
READ of size 1 at 0x60200000c6b2 thread T0
#0 0x4fad7d in literalstring_parse /f/gettext-0.19.4/gettext-tools/src/x-c.c:887:20
#1 0x4f518b in arglist_parser_done /f/gettext-0.19.4/gettext-tools/src/xgettext.c:3099:31
#2 0x4ff01b in extract_parenthesized /f/gettext-0.19.4/gettext-tools/src/x-c.c:2111:11
#3 0x4fde0c in extract_parenthesized /f/gettext-0.19.4/gettext-tools/src/x-c.c:2016:15
#4 0x4fcc35 in extract_whole_file /f/gettext-0.19.4/gettext-tools/src/x-c.c:2144:11
#5 0x4fae27 in extract_c /f/gettext-0.19.4/gettext-tools/src/x-c.c:2163:3
#6 0x4e93dd in extract_from_file /f/gettext-0.19.4/gettext-tools/src/xgettext.c:2043:3
#7 0x4e5e6c in main /f/gettext-0.19.4/gettext-tools/src/xgettext.c:818:7
#8 0x7fc9d5a8af9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289
#9 0x43cfa6 in _start (/mnt/ram/gettext/xgettext+0x43cfa6)

0x60200000c6b2 is located 0 bytes to the right of 2-byte region [0x60200000c6b0,0x60200000c6b2)
allocated by thread T0 here:
#0 0x4c3f72 in malloc (/mnt/ram/gettext/xgettext+0x4c3f72)
#1 0x68ed0a in xmalloc /f/gettext-0.19.4/gettext-tools/gnulib-lib/xmalloc.c:64:7
#2 0x7fff2b6eb67f (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /f/gettext-0.19.4/gettext-tools/src/x-c.c:887 literalstring_parse
Shadow bytes around the buggy address:
0x0c047fff9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff98a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff98b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff98c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff98d0: fa fa 00 02 fa fa[02]fa fa fa fd fa fa fa 00 02
0x0c047fff98e0: fa fa 00 07 fa fa fd fd fa fa 00 00 fa fa 00 fa
0x0c047fff98f0: fa fa 00 04 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff9900: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff9910: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
0x0c047fff9920: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==29054==ABORTING

Hanno Boeck <hanno>

 

Attached Files
file #34306:  xgettext-oob-heap-literalstring_parse-2.c added by hanno (12B - text/x-csrc - variant of heap oob sample)
file #34305:  xgettext-oob-heap-literalstring_parse.c added by hanno (12B - text/x-csrc - sample file triggering out of bounds heap access)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by haible (Updated the item)
  • -unavailable- added by ueno (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Nov 2016 12:05:00 PM UTChaibleCategoryNone=>Programmer tools
      Assigned toNone=>ueno
    Fri 26 Jun 2015 02:54:02 AM UTCuenoStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Wed 24 Jun 2015 02:51:42 PM UTChannoAttached File-=>Added xgettext-oob-heap-literalstring_parse-2.c, #34306
    Wed 24 Jun 2015 01:17:28 PM UTChannoAttached File-=>Added xgettext-oob-heap-literalstring_parse.c, #34305

    Back to the top


    Powered by Savane 3.1-cleanup1