bugGNU cflow - Bugs: bug #61251, use-after-free in cflow at...


bug #61251: use-after-free in cflow at src/parser.c:1298

Submitter:  Irfan Ariq <irfanariq>
Submitted:  Thu 30 Sep 2021 08:02:08 PM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Thu 30 Sep 2021 08:02:08 PM UTC, original submission:  


We are currently working on fuzz testing feature, and we found a heap-use-after-free on `cflow`.

The stack traces are as follow:
==29241==ERROR: AddressSanitizer: heap-use-after-free on address 0x60e000003ef0 at pc 0x55ccc9783d79 bp 0x7fff15477370 sp 0x7fff15477360
READ of size 8 at 0x60e000003ef0 thread T0
    #0 0x55ccc9783d78 in reference .../cflow-1.6/src/parser.c:1298
    #1 0x55ccc9780af5 in expression .../cflow-1.6/src/parser.c:621
    #2 0x55ccc9782336 in func_body .../cflow-1.6/src/parser.c:1051
    #3 0x55ccc9780d6f in parse_function_declaration .../cflow-1.6/src/parser.c:690
    #4 0x55ccc9780975 in parse_declaration .../cflow-1.6/src/parser.c:578
    #5 0x55ccc978071b in yyparse .../cflow-1.6/src/parser.c:528
    #6 0x55ccc977aa1d in main .../cflow-1.6/src/main.c:812
The full stack trace is attached.

Step to reproduce

We configured `cflow` using `CFLAGS="-g -O0 -fsanitize=address" ./configure --disable-shared` and built in using `make -j10; make install`, and run it with:

.../cflow-1.6/install_asan/bin/cflow -o --omit-arguments x -m --number t s --debug -o -s <attached file> 24 /dev/null -n

The input file is attached.

- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- cflow version: [cflow 1.6](https://ftp.gnu.org/gnu/cflow/cflow-1.6.tar.xz)

Thank you.

Irfan Ariq <irfanariq>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #51992:  full_stacktrace_poc_3.zip added by irfanariq (3KiB - application/x-zip-compressed)
file #51993:  input_cflow_poc_3.zip added by irfanariq (2KiB - application/x-zip-compressed)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by irfanariq (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-09-30 irfanariq Attached File- Added full_stacktrace_poc_3.zip, #51992
        Attached File- Added input_cflow_poc_3.zip, #51993

    Back to the top

    Powered by Savane 3.13-1277.
    Corresponding source code