bugGNU gettext - Bugs: bug #47531, One byte heap buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #47531: One byte heap buffer overflow in x-lua.c (triggered by make check)

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Fri 25 Mar 2016 01:02:44 PM UTC  
 
Category: LuaSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Daiki Ueno <ueno>
Open/Closed: Closed

Fri 25 Mar 2016 07:24:45 PM UTC, comment #1:

Thanks, I have pushed the patch:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=0571be87e09c6db11be8c56c773b563c2b4c99a4

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Fri 25 Mar 2016 01:02:44 PM UTC, original submission:

There is a one byte heap buffer overflow in x-lua.c. This is the code:

static void
string_end ()
{
string_buf[string_buf_length] = '\0';
}

The problem is that when string_buf_length is larger than string_buf it will still write. In the function above (string_add) there is a check for that and a call to xrealloc in that case. See attached patch for a similar change to string_end (I realloc only one additional byte because I assume after string_end no more memory is needed).

This was found by running the test suite (make check) with address sanitizer enabled. I'll attach the address sanitizer error message as well.

Hanno Boeck <hanno>

 

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by haible (Updated the item)
  • -unavailable- added by ueno (Posted a comment)
  • -unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Nov 2016 12:09:40 PM UTChaibleCategoryNone=>Lua
      Assigned toNone=>ueno
    Fri 25 Mar 2016 07:24:45 PM UTCuenoStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Fri 25 Mar 2016 01:02:44 PM UTChannoAttached File-=>Added gettext-fix-bufferoverflow.diff, #36761
      Attached File-=>Added gettext-lua-overflow-asan.txt, #36762

    Back to the top


    Powered by Savane 3.1-cleanup1