bugGNU cflow - Bugs: bug #61091, Buffer overflow in cfflow at...


bug #61091: Buffer overflow in cfflow at main:238

Submitter:  Irfan Ariq <irfanariq>
Submitted:  Mon 30 Aug 2021 06:01:05 PM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Mon 30 Aug 2021 06:01:05 PM UTC, original submission:  


We are currently working on fuzz testing feature, and we found a buffer overflow on `cflow`.

The stack traces are as follow:
==628==ERROR: AddressSanitizer: global-buffer-overflow on address 0x556fe0808482 at pc 0x7f3e9c88abb5 bp 0x7ffcd85b89f0 sp 0x7ffcd85b8198
READ of size 4 at 0x556fe0808482 thread T0
    #0 0x7f3e9c88abb4  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xafbb4)
    #1 0x556fe07ca85d in find_option_type .../cflow-1.6/src/main.c:238
    #2 0x556fe07cb9ac in set_level_indent .../cflow-1.6/src/main.c:478
    #3 0x556fe07cbc56 in parse_opt .../cflow-1.6/src/main.c:545
    #4 0x556fe07e97cb in group_parse .../cflow-1.6/gnu/argp-parse.c:236
    #5 0x556fe07ec73d in parser_parse_opt .../cflow-1.6/gnu/argp-parse.c:750
    #6 0x556fe07ed222 in parser_parse_next .../cflow-1.6/gnu/argp-parse.c:862
    #7 0x556fe07ed744 in argp_parse .../cflow-1.6/gnu/argp-parse.c:930
    #8 0x556fe07cc7fc in main .../cflow-1.6/src/main.c:788
    #9 0x7f3e9c40bbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #10 0x556fe07bd659 in _start (.../cflow-1.6/install_asan/bin/cflow+0xf659)

The full stack trace and output are attached.

*Step to reproduce*

We configured `cflow` using

$ CFLAGS="-g -O0 -fsanitize=address" ./configure --disable-shared
, and built it using

$ make -j10; make install

, and run it with:

$ ./cflow --number --tree -o /dev/null <attached file>

The input fila is attached

- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- cflow version: cflow 1.6 (https://ftp.gnu.org/gnu/cflow/cflow-1.6.tar.xz)

Thank you.

Irfan Ariq <irfanariq>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #51841:  input_cflow_1.zip added by irfanariq (1KiB - application/x-zip-compressed)
file #51842:  stacktrace_cflow_1.zip added by irfanariq (1KiB - application/x-zip-compressed)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by irfanariq (Submitted the item)
  • -email is unavailable- added by irfanariq

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-08-30 irfanariq Attached File- Added input_cflow_1.zip, #51841
        Attached File- Added stacktrace_cflow_1.zip, #51842
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code