Mon 23 Oct 2017 08:04:45 AM UTC, original submission:
## Tested Version:
libcdio v0.94
## How reproducible:
iso-info -i $POC
## Description:
In function realloc_symlink at rock.c
65 else {
66 char * psz_newsymlink = (char ) calloc(1, 2i_needed);
67 if (!psz_newsymlink) return false;
68 p_stat->rr.i_symlink_max = 2*i_needed;
69 memcpy(psz_newsymlink, p_stat->rr.psz_symlink, p_stat->rr.i_symlink);
70 free(p_stat->rr.psz_symlink);
71 p_stat->rr.psz_symlink = psz_newsymlink;
72 return true;
73 }
74 }
the buffer allocated can be overwritten by a crafted file, when the code
70 free(p_stat->rr.psz_symlink);
is called, it lead to crashes.
## Crash Information:
The output with address sanitizer enabled
./iso-info -i cdio.get_rock_ridge_filename.rock.261.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.get_rock_ridge_filename.rock.261.crash
System : LINUX
Volume : CDROM
Volume Set :
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: Symlink component flag not implemented
=================================================================
==19844==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61d00001f2a5 at pc 0x00000041bd9c bp 0x7ffc2b28c440 sp 0x7ffc2b28c430
READ of size 1 at 0x61d00001f2a5 thread T0
#0 0x41bd9b in get_rock_ridge_filename /root/libcdio-0.94/lib/iso9660/rock.c:261
#1 0x416e8d in _iso9660_dir_to_statbuf /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:751
#2 0x4198d7 in iso9660_ifs_readdir /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:1393
#3 0x403044 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:224
#4 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#5 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#6 0x7f0183fb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x402798 in _start (/opt/asan/bin/iso-info+0x402798)
0x61d00001f2a5 is located 37 bytes to the right of 2048-byte region [0x61d00001ea80,0x61d00001f280)
allocated by thread T0 here:
#0 0x7f01843f679a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
#1 0x419607 in iso9660_ifs_readdir /root/libcdio-0.94/lib/iso9660/iso9660_fs.c:1363
#2 0x403044 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:224
#3 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#4 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#5 0x7f0183fb482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
SUMMARY: AddressSanitizer: heap-buffer-overflow /root/libcdio-0.94/lib/iso9660/rock.c:261 get_rock_ridge_filename
Shadow bytes around the buggy address:
0x0c3a7fffbe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c3a7fffbe40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c3a7fffbe50: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbe90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c3a7fffbea0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==19844==ABORTING
gdb and backtrace
(gdb) run -i cdio.get_rock_ridge_filename.rock.261.crash
Starting program: /opt/normal/bin/iso-info -i cdio.get_rock_ridge_filename.rock.261.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.get_rock_ridge_filename.rock.261.crash
System : LINUX
Volume : CDROM
Volume Set :
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: Symlink component flag not implemented
2004318071 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
0 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
0 /wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn9nnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn/nnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnn/nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
1313754702 /nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn
808464432 /00000000000000
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
- Error in `/opt/normal/bin/iso-info': free(): invalid next size (fast): 0x0000000000636df0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff7a847e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7ffff7a8d37a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7ffff7a9153c]
/opt/normal/bin/iso-info[0x40a78e]
/opt/normal/bin/iso-info[0x40addb]
/opt/normal/bin/iso-info[0x4082f4]
/opt/normal/bin/iso-info[0x408997]
/opt/normal/bin/iso-info[0x40a2fa]
/opt/normal/bin/iso-info[0x40a358]
/opt/normal/bin/iso-info[0x4025c0]
/opt/normal/bin/iso-info[0x402823]
/opt/normal/bin/iso-info[0x4020ef]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a2d830]
/opt/normal/bin/iso-info[0x402489]
======= Memory map: ========
00400000-0042c000 r-xp 00000000 08:01 1056920 /opt/normal/bin/iso-info
0062c000-0062d000 r--p 0002c000 08:01 1056920 /opt/normal/bin/iso-info
0062d000-0062e000 rw-p 0002d000 08:01 1056920 /opt/normal/bin/iso-info
0062e000-00654000 rw-p 00000000 00:00 0 [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0
7ffff77f7000-7ffff780d000 r-xp 00000000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff780d000-7ffff7a0c000 ---p 00016000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0c000-7ffff7a0d000 rw-p 00015000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0d000-7ffff7bcd000 r-xp 00000000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bcd000-7ffff7dcd000 ---p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dcd000-7ffff7dd1000 r--p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd1000-7ffff7dd3000 rw-p 001c4000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd3000-7ffff7dd7000 rw-p 00000000 00:00 0
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fb9000-7ffff7fdd000 rw-p 00000000 00:00 0
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Program received signal SIGABRT, Aborted.
0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff7a4402a in __GI_abort () at abort.c:89
#2 0x00007ffff7a847ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7ffff7b9de98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007ffff7a8d37a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7ffff7b9df10 "free(): invalid next size (fast)", action=3) at malloc.c:5006
#4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3867
#5 0x00007ffff7a9153c in __GI___libc_free (mem=<optimized out>) at malloc.c:2968
#6 0x000000000040a78e in realloc_symlink (p_stat=0x636c50, i_grow=<optimized out>) at rock.c:70
#7 0x000000000040addb in get_rock_ridge_filename (p_iso9660_dir=p_iso9660_dir@entry=0x636ac2, psz_name=psz_name@entry=0x7fffffffc090 "", p_stat=p_stat@entry=0x636c50)
at rock.c:298
#8 0x00000000004082f4 in _iso9660_dir_to_statbuf (p_iso9660_dir=p_iso9660_dir@entry=0x636ac2, b_xa=nope, u_joliet_level=<optimized out>) at iso9660_fs.c:751
#9 0x0000000000408997 in _fs_iso_stat_traverse (p_iso=p_iso@entry=0x633480, _root=_root@entry=0x6357d0, splitpath=splitpath@entry=0x6362a0) at iso9660_fs.c:1095
#10 0x000000000040a2fa in iso9660_ifs_stat (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/")
at iso9660_fs.c:1247
#11 0x000000000040a358 in iso9660_ifs_readdir (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/")
at iso9660_fs.c:1337
#12 0x00000000004025c0 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=0x635f40 "/", 'n' <repeats 66 times>, "/", 'n' <repeats 11 times>, "/") at iso-info.c:224
#13 0x0000000000402823 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x420b22 "/") at iso-info.c:300
#14 0x00000000004020ef in print_iso9660_fs (iso=0x633480) at iso-info.c:309
#15 main (argc=<optimized out>, argv=<optimized out>) at iso-info.c:501
## CREDIT
Zhao Liang, Huawei Weiran Labs
## POC file
|