bugcombine: Extensible File Matching and Filtering - Bugs: bug #60300, heap buffer overflow

 
 

bug #60300: heap buffer overflow

Submitter:  None
Submitted:  Mon 29 Mar 2021 01:07:50 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 29 Mar 2021 01:07:50 PM UTC, original submission:  

Hi,


given the two input files A and B generated by KLEE, combine crashes.


Kind regards,

Frank


> combine-0.4.0/src/combine A B
=================================================================
==238349==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000031 at pc 0x55c71370bb58 bp 0x7ffc4301bb70 sp 0x7ffc4301bb60
READ of size 1 at 0x602000000031 thread T0
    #0 0x55c71370bb57 in dstrstr combine-0.4.0/src/dstring.c:668
    #1 0x55c71374de2a in df_get_next_record combine-0.4.0/src/read_files.c:118
    #2 0x55c713736b35 in process_data_file combine-0.4.0/src/process_files.c:354
    #3 0x55c713719df4 in df_main combine-0.4.0/src/main.c:162
    #4 0x55c71371990f in main combine-0.4.0/src/main.c:75
    #5 0x7ff69c46fb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)
    #6 0x55c71370840d in _start (ombine-0.4.0/src/combine+0xa40d)

0x602000000031 is located 0 bytes to the right of 1-byte region [0x602000000030,0x602000000031)
allocated by thread T0 here:
    #0 0x7ff69c6c7459 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x55c71370c129 in dstrdupstr combine-0.4.0/src/dstring.c:736
    #2 0x55c71371b55f in initialize_variables combine-0.4.0/src/df_options.c:221
    #3 0x55c71371993e in df_main combine-0.4.0/src/main.c:107
    #4 0x55c71371990f in main combine-0.4.0/src/main.c:75
    #5 0x7ff69c46fb24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)

SUMMARY: AddressSanitizer: heap-buffer-overflow combine-0.4.0/src/dstring.c:668 in dstrstr


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #51156:  B added by None (20B - application/octet-stream)
file #51155:  A added by None (20B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 2 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2021-03-29 None Attached File- Added A, #51155
    Attached File- Added B, #51156

Back to the top

Powered by Savane 3.13-d3ae.
Corresponding source code