bugGNU nano - Bugs: bug #46348, heap overflow of one byte in...

 
 

bug #46348: heap overflow of one byte in function parse_mbchar() with multibyte unicode characters

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Sat 31 Oct 2015 02:58:24 PM UTC  
 
Severity: 3 - NormalStatus: Duplicate
Assigned to: Benno Schulenberg <bens>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 31 Oct 2015 05:26:28 PM UTC, comment #3:

I found this through normal use (currently trying to generate a Gentoo system built with address sanitizer).

But fuzzing also works, just replicated that, afl found the same issue within seconds. Seems if nano doesn't have a console it will parse the file and then quit because it can't open. That's exactly what you want for fuzzing, so it's straightforward.

I also tried fuzzing the latest nano svn (which has the fix). Nothing found yet, but if that changes I'll report it :-)

Hanno Boeck <hanno>
Sat 31 Oct 2015 05:11:04 PM UTC, comment #2:

Thanks for reporting! (I'll close the bug when a version containing the fix has been released. I'm waiting for Chris to release 2.4.3 or 2.5.0.)

By the way, did you run into this bug by normal usage, or by fuzzing nano? If the latter, how could I do that?

Benno Schulenberg <bens>
Project AdministratorIn charge of this item.
Sat 31 Oct 2015 03:21:08 PM UTC, comment #1:

Apologies, I haven't checked the svn code. It seems this is already fixed with commit revision 5347 and this is actually a duplicate of bug #45718.

It seems I don't have permission to close this bug myself, so please feel free to close it.

Hanno Boeck <hanno>
Sat 31 Oct 2015 02:58:24 PM UTC, original submission:

I noticed a write heap overflow in nano when typing in a $ and any 3-byte or 4-byte unicode char. On a US intl keyboard layout this can e.g. be achieved with altgr-0. But it can also just be tested with the attached file.

This can be seen with address sanitizer (-fsanitize=address CFLAGS) or with valgrind.

Address Sanitizer output:

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #35348:  nano-heapoverflow-write-parse_mbchar added by hanno (4B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bens (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Dec 2015 03:17:50 PM UTCbensOpen/ClosedOpen=>Closed
    Sat 31 Oct 2015 05:11:04 PM UTCbensStatusNone=>Duplicate
      Assigned toNone=>bens
      SummaryHeap overflow of one byte in function parse_mbchar with multibyte unicode characters=>heap overflow of one byte in function parse_mbchar() with multibyte unicode characters
    Sat 31 Oct 2015 02:58:24 PM UTChannoAttached File-=>Added nano-heapoverflow-write-parse_mbchar, #35348

    Back to the top


    Powered by Savane 3.1-cleanup1