bugGNU Scientific Library - Bugs: bug #59624, Buffer overflow in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #59624: Buffer overflow in gsl_stats_quantile_from_sorted_data

Submitted by:  Patrick Alken <psa>
Submitted on:  Fri 04 Dec 2020 10:06:37 PM UTC
 
Category:  Runtime error Severity:  3 - Normal
Operating System:  Status:  Fixed
Assigned to:  None Open/Closed:  Closed
Release: 
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       

 

Sat 16 Apr 2022 05:57:56 PM UTC, comment #2: 

fixed in commit 989a193268b963aa1047814f7f1402084fb7d859

Patrick Alken <psa>
Project Administrator
Sun 17 Jan 2021 10:24:30 PM UTC, comment #1: 

from msunet =at= shellblade =dot= net

This one is a "fix" for bug 59624, simply checking that |f| is in the expected range.
Though I don't think there is ultimately a way to check in C whether the given
array has the right size, so a buggy application can still trigger the bug
described in the email thread.

---
 statistics/quantiles_source.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/statistics/quantiles_source.c b/statistics/quantiles_source.c
index e2956d9d..bf93a1a3 100644
--- a/statistics/quantiles_source.c
+++ b/statistics/quantiles_source.c
@@ -17,6 +17,7 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  */

+#include <assert.h>

 double
 FUNCTION(gsl_stats,quantile_from_sorted_data) (const BASE sorted_data[],
@@ -24,6 +25,8 @@ FUNCTION(gsl_stats,quantile_from_sorted_data) (const BASE sorted_data[],
                                                const size_t n,
                                                const double f)
 {
+  assert(0.0 <= f && f <= 1.0);
+
   const double index = f * (n - 1) ;
   const size_t lhs = (int)index ;
   const double delta = index - lhs ;
--
2.27.0

Patrick Alken <psa>
Project Administrator
Fri 04 Dec 2020 10:06:37 PM UTC, original submission:  

from zhoulai.fu =at= gmail =dot= com

Running the following code (also attached as a file) triggers a segmentation error.

#include <stdio.h>
#include <gsl/gsl_sort.h>
#include <gsl/gsl_statistics.h>

int main(void)
{
  double upperq;
  double data[5] = {17.2, 18.1, 16.5, 18.3, 12.6};
  gsl_sort (data, 1, 5);
  upperq = gsl_stats_quantile_from_sorted_data (data, 1, 5, 675);
  return 0;
}
// gcc statsort_bug.c -lgsl -lgslcblas; ./a.out

The error points to statistics/quantiles_source.c:41:

      result = (1 - delta) * sorted_data[lhs * stride] + delta * sorted_data[(lhs + 1) * stride] ;

The segmentation error is due to a stack buffer overflow (where
lhs=2700, strid=1 as shown in GDB). The bug could be exploited for
security attack, knowing that it occurs when the quantile "f" is
beyond the expected [0,1] range (f=675 in this case).

Patrick Alken <psa>
Project Administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #50406:  statsort_bug.c added by psa (316B - text/x-csrc)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by psa (Submitted the item)
  •  

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-04-16 psa StatusNone => Fixed
        Open/ClosedOpen => Closed
    2020-12-04 psa Attached File- => Added statsort_bug.c, #50406

    Back to the top


    Powered by Savane 3.9