bugCompact Disc Input and Control Library - Bugs: bug #52265, A heap-buffer-overflow...

 
 

bug #52265: A heap-buffer-overflow vulneribility in print_iso9660_recurse

Submitted by:  Zhao Liang <zhao_liang>
Submitted on:  Mon 23 Oct 2017 08:37:07 AM UTC  
 
Category:  utility program Severity:  5 - Average
Item Group:  iso-info Status:  Fixed
Privacy:  Public Assigned to:  Rocky Bernstein <rocky>
Open/Closed:  Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 22 Nov 2017 01:26:44 AM UTC, comment #2:

Current git sources have fixed this. There will soon be a 1.0.0 release with those fixes.

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Tue 24 Oct 2017 01:50:43 AM UTC, comment #1:

I am not seeing this behavior with ddd984854b09c1a8203867534c087c0d83ff8622

Rocky Bernstein <rocky>
Project AdministratorIn charge of this item.
Mon 23 Oct 2017 08:37:07 AM UTC, original submission:

## Tested Version:
libcdio v0.94

## How reproducible:
iso-info -i $POC

## Description:
in print_iso9660_recurse function, this code
222 char translated_name = (char ) malloc(4096);
allocate 4096 buffer, the buffer was overwritten with other code and cause the crash

## Crash Information:
The output with address sanitizer enabled
./iso-info -i cdio.print_iso9660_recurse.iso-info.257.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.print_iso9660_recurse.iso-info.257.crash
System : LINQX
Volume : CDROM
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
=================================================================
==20217==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001c900 at pc 0x7f1c725b61e9 bp 0x7ffe0d608ab0 sp 0x7ffe0d608228
READ of size 4097 at 0x62100001c900 thread T0
#0 0x7f1c725b61e8 (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x601e8)
#1 0x7f1c725b7145 in __interceptor_vsnprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x61145)
#2 0x7f1c725b73b1 in snprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x613b1)
#3 0x403276 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:257
#4 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#5 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#6 0x7f1c721ac82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x402798 in _start (/opt/asan/bin/iso-info+0x402798)

0x62100001c900 is located 0 bytes to the right of 4096-byte region [0x62100001b900,0x62100001c900)
allocated by thread T0 here:
#0 0x7f1c725ee602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x403019 in print_iso9660_recurse /root/libcdio-0.94/src/iso-info.c:222
#2 0x4037b0 in print_iso9660_fs /root/libcdio-0.94/src/iso-info.c:309
#3 0x404571 in main /root/libcdio-0.94/src/iso-info.c:501
#4 0x7f1c721ac82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
0x0c427fffb8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffb920:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==20217==ABORTING

gdb and backtrace
./iso-info -i cdio.print_iso9660_recurse.iso-info.257.crash
iso-info version 0.94 x86_64-pc-linux-gnu
Copyright (c) 2003-2005, 2007-2008, 2011-2015 R. Bernstein
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
________________________________
ISO 9660 image: cdio.print_iso9660_recurse.iso-info.257.crash
System : LINQX
Volume : CDROM
No Joliet extensions
________________________________
ISO-9660 Information
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
2048 /
2048 /a(
0 /a(
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /000000000000000000000000000000000000000000000000
808464432 /00000
808464432 /0000000000000000000000000
0 /0000000000000000000000000
0 /0000000000000000000000000
0 /0000000000000000000000000
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
2048 // 2048 //a(
0 //a(
808464432 //000000000000000000000000000000000000000000000000
808464432 //000000000000000000000000000000000000000000000000
808464432 //000000000000000000000000000000000000000000000000
808464432 //000000000000000000000000000000000000000000000000
808464432 //000000000000000000000000000000000000000000000000
808464432 //000000000000000000000000000000000000000000000000
808464432 //00000
808464432 //0000000000000000000000000
0 //0000000000000000000000000
0 //0000000000000000000000000
0 //0000000000000000000000000
++ WARN: from_733: broken byte order
++ WARN: Bad directory information for Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: from_733: broken byte order
++ WARN: from_733: broken byte order
Error getting above directory information
++ WARN: from_733: broken byte order
++ WARN: Bad directory information for 0000000000000000000000000
Error getting above directory information
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented
++ WARN: Symlink component flag not implemented

      • Error in `/opt/normal/bin/iso-info': malloc(): memory corruption: 0x0000000000635240 ***

======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7ffff7a847e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8213e)[0x7ffff7a8f13e]
/lib/x86_64-linux-gnu/libc.so.6(__libc_calloc+0xba)[0x7ffff7a91dca]
/opt/normal/bin/iso-info[0x40a767]
/opt/normal/bin/iso-info[0x40addb]
/opt/normal/bin/iso-info[0x4082f4]
/opt/normal/bin/iso-info[0x40a439]
/opt/normal/bin/iso-info[0x4025c0]
/opt/normal/bin/iso-info[0x402823]
/opt/normal/bin/iso-info[0x4020ef]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7ffff7a2d830]
/opt/normal/bin/iso-info[0x402489]
======= Memory map: ========
00400000-0042c000 r-xp 00000000 08:01 1056920 /opt/normal/bin/iso-info
0062c000-0062d000 r--p 0002c000 08:01 1056920 /opt/normal/bin/iso-info
0062d000-0062e000 rw-p 0002d000 08:01 1056920 /opt/normal/bin/iso-info
0062e000-00654000 rw-p 00000000 00:00 0 [heap]
7ffff0000000-7ffff0021000 rw-p 00000000 00:00 0
7ffff0021000-7ffff4000000 ---p 00000000 00:00 0
7ffff77f7000-7ffff780d000 r-xp 00000000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff780d000-7ffff7a0c000 ---p 00016000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0c000-7ffff7a0d000 rw-p 00015000 08:01 791595 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a0d000-7ffff7bcd000 r-xp 00000000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7bcd000-7ffff7dcd000 ---p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dcd000-7ffff7dd1000 r--p 001c0000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd1000-7ffff7dd3000 rw-p 001c4000 08:01 791557 /lib/x86_64-linux-gnu/libc-2.23.so
7ffff7dd3000-7ffff7dd7000 rw-p 00000000 00:00 0
7ffff7dd7000-7ffff7dfd000 r-xp 00000000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7fb9000-7ffff7fdd000 rw-p 00000000 00:00 0
7ffff7ff5000-7ffff7ff8000 rw-p 00000000 00:00 0
7ffff7ff8000-7ffff7ffa000 r--p 00000000 00:00 0 [vvar]
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00025000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffd000-7ffff7ffe000 rw-p 00026000 08:01 791529 /lib/x86_64-linux-gnu/ld-2.23.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Program received signal SIGABRT, Aborted.
0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff7a42428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1 0x00007ffff7a4402a in __GI_abort () at abort.c:89
#2 0x00007ffff7a847ea in __libc_message (do_abort=2, fmt=fmt@entry=0x7ffff7b9de98 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007ffff7a8f13e in malloc_printerr (ar_ptr=0x7ffff7dd1b20 <main_arena>, ptr=0x635240, str=0x7ffff7b9acff "malloc(): memory corruption", action=<optimized out>)
at malloc.c:5006
#4 _int_malloc (av=av@entry=0x7ffff7dd1b20 <main_arena>, bytes=bytes@entry=560) at malloc.c:3474
#5 0x00007ffff7a91dca in __libc_calloc (n=<optimized out>, elem_size=<optimized out>) at malloc.c:3236
#6 0x000000000040a767 in realloc_symlink (p_stat=0x6347c0, i_grow=<optimized out>) at rock.c:66
#7 0x000000000040addb in get_rock_ridge_filename (p_iso9660_dir=p_iso9660_dir@entry=0x634e51, psz_name=psz_name@entry=0x7fffffffc110 "", p_stat=p_stat@entry=0x6347c0)
at rock.c:298
#8 0x00000000004082f4 in _iso9660_dir_to_statbuf (p_iso9660_dir=p_iso9660_dir@entry=0x634e51, b_xa=nope, u_joliet_level=<optimized out>) at iso9660_fs.c:751
#9 0x000000000040a439 in iso9660_ifs_readdir (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x6359d0 "/a(/") at iso9660_fs.c:1393
#10 0x00000000004025c0 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=0x6359d0 "/a(/") at iso-info.c:224
#11 0x0000000000402823 in print_iso9660_recurse (p_iso=p_iso@entry=0x633480, psz_path=psz_path@entry=0x420b22 "/") at iso-info.c:300
#12 0x00000000004020ef in print_iso9660_fs (iso=0x633480) at iso-info.c:309
#13 main (argc=<optimized out>, argv=<optimized out>) at iso-info.c:501

## CREDIT
Zhao Liang, Huawei Weiran Labs

## POC file

Zhao Liang <zhao_liang>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #42234:  cdio.print_iso9660_recurse.iso-info.257.crash added by zhao_liang (50KiB - application/octet-stream - POC file that crashing catdoc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by zhao_liang (Submitted the item)
  • -email is unavailable- added by zhao_liang
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-11-22 rocky StatusNone => Fixed
        Assigned toNone => rocky
    2017-10-23 zhao_liang Attached File- => Added cdio.print_iso9660_recurse.iso-info.257.crash, #42234
        Carbon-Copy- => Added rocky

    Back to the top


    Powered by Savane 3.3