bugGNU Screen - Bugs: bug #53173, Out of bounds heap memory read in...


bug #53173: Out of bounds heap memory read in MClearArea()

Submitted by:  None
Submitted on:  Fri 16 Feb 2018 09:58:10 PM UTC  
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Release:  4.6.2
Fixed Release:  None Planned Release:  None
Work Required:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Sun 04 Mar 2018 11:16:06 AM UTC, comment #1: 

attached preliminary fix, but would like to spend some more time looking into it, particularly the macro one seems like it may cause some problems, although I didn't see any in my testing

(file #43458)

Amadeusz Sławiński <amade>
Project Administrator
Fri 16 Feb 2018 09:58:10 PM UTC, original submission:  

I detected an out of bounds heap read in screen when building with address sanitizer. Happens both in 4.6.2 and current git, though the code changed a bit, so the line numbers differ. I'll attach stack traces for both.

This can be reliably reproduced for me by:
1. compile screen with -fsanitize=address in CFLAGS+LDFLAGS.
2. run screen in a terminal emulator.
3. Press ctrl-a.
4. Resize the window.

Screen will hang and the main process will have crashed with an oob read in MClearArea.

Stack trace:
==19786==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x615000001154 at pc 0x561d8c848842 bp 0x7ffdea718400 sp 0x7ffdea7183f0
READ of size 4 at 0x615000001154 thread T0
    #0 0x561d8c848841 in MClearArea /mnt/ram/screen/src/ansi.c:2117
    #1 0x561d8c8411ab in ClearLineRegion /mnt/ram/screen/src/ansi.c:1636
    #2 0x561d8c8390a8 in DoCSI /mnt/ram/screen/src/ansi.c:887
    #3 0x561d8c834085 in WriteString /mnt/ram/screen/src/ansi.c:426
    #4 0x561d8c937335 in win_readev_fn /mnt/ram/screen/src/window.c:1443
    #5 0x561d8c90ae42 in sched /mnt/ram/screen/src/sched.c:164
    #6 0x561d8c8250f9 in main /mnt/ram/screen/src/screen.c:1075
    #7 0x7f33026c8f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)
    #8 0x561d8c8204a9 in _start (/mnt/ram/screen/src/screen+0x294a9)

0x615000001154 is located 0 bytes to the right of 468-byte region [0x615000000f80,0x615000001154)
allocated by thread T0 here:
    #0 0x7f33033ff220 in realloc (/usr/lib/gcc/x86_64-pc-linux-gnu/7.3.0/libasan.so.4+0xe1220)
    #1 0x561d8c90640d in xrealloc /mnt/ram/screen/src/resize.c:455
    #2 0x561d8c90503f in CheckMaxSize /mnt/ram/screen/src/resize.c:394
    #3 0x561d8c901cb1 in ChangeScreenSize /mnt/ram/screen/src/resize.c:128
    #4 0x561d8c901518 in CheckScreenSize /mnt/ram/screen/src/resize.c:100
    #5 0x561d8c9150f0 in ReceiveMsg /mnt/ram/screen/src/socket.c:813
    #6 0x561d8c828ee7 in serv_read_fn /mnt/ram/screen/src/screen.c:1627
    #7 0x561d8c90ae42 in sched /mnt/ram/screen/src/sched.c:164
    #8 0x561d8c8250f9 in main /mnt/ram/screen/src/screen.c:1075
    #9 0x7f33026c8f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #43335:  screen-asan-oob-4.6.2.txt added by None (3KiB - text/plain - full asan errors)
file #43336:  screen-asan-oob-git.txt added by None (3KiB - text/plain - full asan errors)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by amade (Updated the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-03-04 amade Attached File- => Added 0001-fix-out-of-bound-accesses.patch, #43458
    2018-02-16 None Attached File- => Added screen-asan-oob-4.6.2.txt, #43335
        Attached File- => Added screen-asan-oob-git.txt, #43336

    Back to the top

    Powered by Savane 3.6