bugCompact Disc Input and Control Library - Bugs: bug #52263, A heap-buffer-overflow...

 
 

bug #52263: A heap-buffer-overflow vulneribility in realloc_symlink

Submitted by:  Zhao Liang <zhao_liang>
Submitted on:  Mon 23 Oct 2017 08:04:45 AM UTC  
 
Category: utility programSeverity: 5 - Average
Item Group: iso-infoStatus: Works For Me
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 24 Oct 2017 01:48:08 AM UTC, comment #1:

I am not seeing this behavior with ddd984854b09c1a8203867534c087c0d83ff8622

Rocky Bernstein <rocky>
Project Administrator
Mon 23 Oct 2017 08:04:45 AM UTC, original submission:

## Tested Version:
libcdio v0.94

## How reproducible:
iso-info -i $POC

## Description:
In function realloc_symlink at rock.c
65 else {
66 char * psz_newsymlink = (char ) calloc(1, 2i_needed);
67 if (!psz_newsymlink) return false;
68 p_stat->rr.i_symlink_max = 2*i_needed;
69 memcpy(psz_newsymlink, p_stat->rr.psz_symlink, p_stat->rr.i_symlink);
70 free(p_stat->rr.psz_symlink);
71 p_stat->rr.psz_symlink = psz_newsymlink;
72 return true;
73 }
74 }
the buffer allocated can be overwritten by a crafted file, when the code
70 free(p_stat->rr.psz_symlink);
is called, it lead to crashes.

## Crash Information:
The output with address sanitizer enabled
./iso-info -i cdio.get_rock_ridge_filename.rock.261.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.get_rock_ridge_filename.rock.261.crash
System : LINUX
Volume : CDROM
Volume Set :

No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: Symlink component flag not implemented
=================================================================
==19844==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00001f2a5 at pc 0x00000041bd9c bp 0x7ffc2b28c440 sp 0x7ffc2b28c430
READ of size 1 at 0x61d00001f2a5 thread T0
#0 0x41bd9b in get_rock_ridge_filename /root/libcdio-0.94/lib/iso9660/rock.c:261
#1 0x416e8d in _iso9660_dir_to_statbuf /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:751
#2 0x4198d7 in iso9660_ifs_readdir /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:1393
#3 0x403044 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:224
#4 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#5 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#6 0x7f0183fb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x402798 in _start (/opt/asan/bin/iso-info+0x402798)

0x61d00001f2a5 is located 37 bytes to the right of 2048-byte region [0x61d00001ea80,0x61d00001f280)
allocated by thread T0 here:
#0 0x7f01843f679a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x419607 in iso9660_ifs_readdir /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:1363
#2 0x403044 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:224
#3 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#4 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#5 0x7f0183fb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/libcdio-0.94/lib/iso9660/rock.c:261 get_rock_ridge_filename
Shadow bytes around the buggy address:
0x0c3a7fffbe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a7fffbe50: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==19844==ABORTING

gdb and backtrace
(gdb) run -i cdio.get_rock_ridge_filename.rock.261.crash
Starting program: /opt/normal/bin/iso-info -i cdio.get_rock_ridge_filename.rock.261.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.get_rock_ridge_filename.rock.261.crash
System : LINUX
Volume : CDROM
Volume Set :

No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: Symlink component flag not implemented
2004318071 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
0 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
0 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn9nnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn/nnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnn/nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
808464432 /00000000000000
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented

      • Error in `/opt/normal/bin/iso-info': free(): invalid next size (fast): 0x0000000000636df0 ***

======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff7a847e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7ffff7a8d37a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7ffff7a9153c]
/opt/normal/bin/iso-info[0x40a78e]
/opt/normal/bin/iso-info[0x40addb]
/opt/normal/bin/iso-info[0x4082f4]
/opt/normal/bin/iso-info[0x408997]
/opt/normal/bin/iso-info[0x40a2fa]
/opt/normal/bin/iso-info[0x40a358]
/opt/normal/bin/iso-info[0x4025c0]
/opt/normal/bin/iso-info[0x402823]
/opt/normal/bin/iso-info[0x4020ef]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a2d830]
/opt/normal/bin/iso-info[0x402489]
======= Memory map: ========
00400000-0042c000 r-xp 00000000 08:01 1056920 /opt/normal/bin/iso-info
0062c000-0062d000 r--p 0002c000 08:01 1056920 /opt/normal/bin/iso-info
0062d000-0062e000 rw-p 0002d000 08:01 1056920 /opt/normal/bin/iso-info
0062e000-00654000 rw-p 00000000 00:00 0 [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0
7ffff77f7000-7ffff780d000 r-xp 00000000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff780d000-7ffff7a0c000 ---p 00016000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0c000-7ffff7a0d000 rw-p 00015000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0d000-7ffff7bcd000 r-xp 00000000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bcd000-7ffff7dcd000 ---p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dcd000-7ffff7dd1000 r--p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd1000-7ffff7dd3000 rw-p 001c4000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd3000-7ffff7dd7000 rw-p 00000000 00:00 0
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fb9000-7ffff7fdd000 rw-p 00000000 00:00 0
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff7a4402a in __GI_abort () at abort.c:89
#2 0x00007ffff7a847ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7b9de98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007ffff7a8d37a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7ffff7b9df10 "free(): invalid next size (fast)", action=3) at malloc.c:5006
#4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3867
#5 0x00007ffff7a9153c in __GI___libc_free (mem=<optimized out>) at malloc.c:2968
#6 0x000000000040a78e in realloc_symlink (p_stat=0x636c50, i_grow=<optimized out>) at rock.c:70
#7 0x000000000040addb in get_rock_ridge_filename (p_iso9660_dir=p_iso9660_dir@entry=0x636ac2, psz_name=psz_name@entry=0x7fffffffc090 "", p_stat=p_stat@entry=0x636c50)
at rock.c:298
#8 0x00000000004082f4 in _iso9660_dir_to_statbuf (p_iso9660_dir=p_iso9660_dir@entry=0x636ac2, b_xa=nope, u_joliet_level=<optimized out>) at iso9660_fs.c:751
#9 0x0000000000408997 in _fs_iso_stat_traverse (p_iso=p_iso@entry=0x633480, _root=_root@entry=0x6357d0, splitpath=splitpath@entry=0x6362a0) at iso9660_fs.c:1095
#10 0x000000000040a2fa in iso9660_ifs_stat (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/")
at iso9660_fs.c:1247
#11 0x000000000040a358 in iso9660_ifs_readdir (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/")
at iso9660_fs.c:1337
#12 0x00000000004025c0 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/") at iso-info.c:224
#13 0x0000000000402823 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x420b22 "/") at iso-info.c:300
#14 0x00000000004020ef in print_iso9660_fs (iso=0x633480) at iso-info.c:309
#15 main (argc=<optimized out>, argv=<optimized out>) at iso-info.c:501

## CREDIT
Zhao Liang, Huawei Weiran Labs

## POC file

Zhao Liang <zhao_liang>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #42232:  cdio.get_rock_ridge_filename.rock.261.crash added by zhao_liang (48KiB - application/octet-stream - POC file that crash iso-info)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rocky (Posted a comment)
  • -unavailable- added by zhao_liang (Submitted the item)
  • -unavailable- added by zhao_liang
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 24 Oct 2017 01:48:08 AM UTCrockyStatusNone=>Works For Me
      Open/ClosedOpen=>Closed
    Mon 23 Oct 2017 08:04:45 AM UTCzhao_liangAttached File-=>Added cdio.get_rock_ridge_filename.rock.261.crash, #42232
      Carbon-Copy-=>Added rocky

    Back to the top


    Powered by Savane 3.1-cleanup1