bugGNU patch - Bugs: bug #56683, Double free in pch.c:1187

 
 

bug #56683: Double free in pch.c:1187

Submitted by:  Manh-Dung Nguyen <strongcourage>
Submitted on:  Sun 28 Jul 2019 07:01:53 AM UTC  
 
Category:  Parser / Internal Representation Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 28 Jul 2019 07:01:53 AM UTC, original submission:  

Hi,

I found a double free in pch.c:1187 (the latest commit 76e7758 on master). This bug causes the program patch to crash.

PoC: https://github.com/strongcourage/PoCs/blob/master/patch_76e7758/PoC_df
Command: patch -Rf < $PoC

ASAN says:
==2576==ERROR: AddressSanitizer: attempting double-free on 0x60200000ed90 in thread T0:
    #0 0x7f237fe6832a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x414188 in another_hunk ../../src/pch.c:1187
    #2 0x406ce2 in main ../../src/patch.c:408
    #3 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #4 0x4037e8 in _start (/home/dungnguyen/PoCs/patch_76e7758/patch-asan+0x4037e8)

0x60200000ed90 is located 0 bytes inside of 4-byte region [0x60200000ed90,0x60200000ed94)
freed by thread T0 here:
    #0 0x7f237fe6832a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x414188 in another_hunk ../../src/pch.c:1187
    #2 0x406ce2 in main ../../src/patch.c:408
    #3 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x7f237fe68662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0x421b71 in savebuf ../../src/util.c:869
    #2 0x415595 in another_hunk ../../src/pch.c:1443
    #3 0x406ce2 in main ../../src/patch.c:408
    #4 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Thanks,
Manh Dung

Manh-Dung Nguyen <strongcourage>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #47273:  PoC_df added by strongcourage (769B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by agruen (Updated the item)
  • -email is unavailable- added by strongcourage (Submitted the item)
  • -email is unavailable- added by strongcourage
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-07-28 agruen CategoryNone => Parser / Internal Representation
    2019-07-28 strongcourage Attached File- => Added PoC_df, #47273
        Carbon-Copy- => Added nguyenmanhdung1710@gmail.com

    Back to the top


    Powered by Savane 3.5