bugncurses - Bugs: bug #58973, Access not within mapped region at...

 
 

bug #58973: Access not within mapped region at address 0x0

Submitter:  施瑞恒 <ayao>
Submitted:  Tue 18 Aug 2020 01:15:47 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 18 Aug 2020 07:54:00 AM UTC, comment #1: 

The current release is ncurses 6.2, and several issues such as this have already been reported, and fixed.

The usual place for reporting and discussing bugs is the mailing list (where recently a few "6.1" bugs have been re-reported).

https://lists.gnu.org/archive/html/bug-ncurses/
https://invisible-island.net/ncurses/ncurses.faq.html#report_bugs

Thomas Dickey <dickey>
Group administrator
Tue 18 Aug 2020 01:15:47 AM UTC, original submission:  

Hi,
 

I am using fuzzing to detect vulnerabilities in some real-world
applications. I found a invaild address access in infotocap. Here is some information about this vulnerability.

version: ncurses-6.1
command: valgrind ./infotocap -v ./crash_infotocap
part of output:
==3720== Invalid read of size 1
==3720==    at 0x49BB0F0: __strchr_avx2 (strchr-avx2.S:45)
==3720==    by 0x12CDD5: _nc_parse_entry (parse_entry.c:547)
==3720==    by 0x1296FB: _nc_read_entry_source (comp_parse.c:225)
==3720==    by 0x114096: main (tic.c:961)
==3720==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

I found that on line 547 of file parse_entry.c, function: strchr
accesses the address pointed by pointer:(char*)entry->uses[0].name, however the address pointed by (char*)entry->uses[0].name is 0x0. This results in accessing violation at address 0x0.

The crash file "crash_infotocap" is attached below. If you have any questions, please contact me. I am looking forword for your reply.



施瑞恒 <ayao>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #49685:  crash_infotocap added by ayao (11KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dickey (Posted a comment)
  • -email is unavailable- added by ayao
  • -email is unavailable- added by ayao (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-08-23 dickey Open/ClosedOpen Closed
    2020-08-18 dickey StatusNone Invalid
    2020-08-18 ayao Attached File- Added crash_infotocap, #49685
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code