bugPSPP - Bugs: bug #58586, stack-buffer-overflow in...

 
 

bug #58586: stack-buffer-overflow in lex_ellipsize__

Submitter:  Andrea Fioraldi <andreafioraldi>
Submitted:  Tue 16 Jun 2020 07:15:23 PM UTC
   
 
Category:  Syntax Parser Severity:  5 - Average
Status:  Fixed Assigned to:  None
Open/Closed:  Closed Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 16 Jun 2020 08:14:29 PM UTC, comment #1: 

I see this too.

John Darrington <jmd>
Group administrator
Tue 16 Jun 2020 07:15:23 PM UTC, original submission:  

Hi, I found this stack overflow while fuzzing with AddressSanitizer.

Reproduce with ./pspp -O format=txt -o /dev/null -b stack_overflow_1


=================================================================
==54798==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffd910 at pc 0x000000485d1e bp 0x7fffffffd850 sp 0x7fffffffd010
WRITE of size 4 at 0x7fffffffd910 thread T0
    #0 0x485d1d in strcpy (/home/andreaf/real/pspp/pspp_afl+0x485d1d)
    #1 0x62dc4f in lex_ellipsize__ /home/andreaf/real/pspp/src/language/lexer/lexer.c:1251:3
    #2 0x62dc4f in lex_source_error_valist /home/andreaf/real/pspp/src/language/lexer/lexer.c:1273:11
    #3 0x63e806 in lex_get_error /home/andreaf/real/pspp/src/language/lexer/lexer.c:1309:3
    #4 0x62a1fb in lex_source_get__ /home/andreaf/real/pspp/src/language/lexer/lexer.c
    #5 0x62817f in lex_get /home/andreaf/real/pspp/src/language/lexer/lexer.c:229:10
    #6 0x63c8f8 in lex_discard_rest_of_command /home/andreaf/real/pspp/src/language/lexer/lexer.c:1114:5
    #7 0x4d0aac in do_parse_command /home/andreaf/real/pspp/src/language/command.c:244:3
    #8 0x4d0aac in cmd_parse_in_state /home/andreaf/real/pspp/src/language/command.c:148:12
    #9 0x4c9df6 in main /home/andreaf/real/pspp/src/ui/terminal/main.c:138:20
    #10 0x7ffff61a5b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #11 0x421499 in _start (/home/andreaf/real/pspp/pspp_afl+0x421499)

Address 0x7fffffffd910 is located in stack of thread T0 at offset 176 in frame
    #0 0x62d59f in lex_source_error_valist /home/andreaf/real/pspp/src/language/lexer/lexer.c:1257

  This frame has 4 object(s):
    [32, 36) 'uc.i.i' (line 942)
    [48, 72) 's' (line 1259)
    [112, 176) 'syntax_cstr' (line 1271) <== Memory access at offset 176 overflows this variable
    [208, 264) 'm' (line 1287)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/andreaf/real/pspp/pspp_afl+0x485d1d) in strcpy
Shadow bytes around the buggy address:
  0x10007fff7ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10007fff7b10: f8 f2 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00
=>0x10007fff7b20: 00 00[f2]f2 f2 f2 f8 f8 f8 f8 f8 f8 f8 f3 f3 f3
  0x10007fff7b30: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b40: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10007fff7b50: 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
  0x10007fff7b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==54798==ABORTING


Andrea Fioraldi <andreafioraldi>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #49280:  stack_overflow_1 added by andreafioraldi (1KiB - application/octet-stream - bug repro testcase)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jmd (Posted a comment)
  • -email is unavailable- added by andreafioraldi (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-20 jmd StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2020-06-16 jmd StatusNone Confirmed
    2020-06-16 andreafioraldi Attached File- Added stack_overflow_1, #49280

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code