bugGNU tar - Bugs: bug #61963, Memory Leak vulnerability

 
 

bug #61963: Memory Leak vulnerability

Submitter:  Moe <entropy1337>
Submitted:  Sat 29 Jan 2022 11:46:39 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 11 Feb 2023 12:33:15 PM UTC, comment #1: 

You have not supplied enough information for identifying the problem. At least, the archive used for testing should have been attached.

Sergey Poznyakoff <gray>
Group administrator
Sat 29 Jan 2022 11:46:39 AM UTC, original submission:  

entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ ../../tar -xf id:000000,sig:06,src:000699+000662,op:splice,rep:64 -C ../tmpdir2/
../../tar: Cannot connect to id: resolve failed

=================================================================
==15390==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 56 byte(s) in 1 object(s) allocated from:
    #0 0x4bb398  (/home/entropy/victims/tar-1.34/src/tar+0x4bb398)
    #1 0x61c670  (/home/entropy/victims/tar-1.34/src/tar+0x61c670)

SUMMARY: AddressSanitizer: 56 byte(s) leaked in 1 allocation(s).
entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ addr2line ../../tar
tar    tar.c  tar.h  tar.o
entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ addr2line ../../tar
tar    tar.c  tar.h  tar.o
entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ addr2line -e ../../tar -a 0x4bb398
0x00000000004bb398
??:?
entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ addr2line -e ../../tar -a 0x61c670
0x000000000061c670
/home/entropy/victims/tar-1.34/gnu/xmalloc.c:53 (discriminator 1)


 48  /* Allocate N bytes of memory dynamically, with error checking.  */
    49
    50  void *
    51  xmalloc (size_t n)
    52  {
    53    void *p = malloc (n);
    54    if (!p && (HAVE_GNU_MALLOC || n))
    55      xalloc_die ();
    56    return p;
    57  }
    58
    59  /* Change the size of an allocated block of memory P to N bytes,
    60     with error checking.  */
    61
    62  void *
    63  xrealloc (void *p, size_t n)
    64  {
    65    if (!HAVE_GNU_REALLOC && !n && p)
    66      {
    67        /* The GNU and C99 realloc behaviors disagree here.  Act like GNU.  */
    68        free (p);
    69        return NULL;
    70      }
    71
    72    void *r = realloc (p, n);
    73    if (!r && (n || (HAVE_GNU_REALLOC && !p)))
    74      xalloc_die ();
    75    return r;
    76  }
    77
    78  /* If P is null, allocate a block of at least *PN bytes; otherwise,
    79     reallocate P so that it contains more than *PN bytes.  *PN must be
    80     nonzero unless P is null.  Set *PN to the new block's size, and
    81     return the pointer to the new block.  *PN is never set to zero, and
    82     the returned pointer is never null.  */
    83
    84  void *
    85  x2realloc (void *p, size_t *pn)


Most likely occurance of the memory leak on the allocation of memory

tar -xf id:000000,sig:06,src:000699+000662,op:splice,rep:64 -C tmpdir

entropy@thickfuzzer:~/victims/tar-1.34/src/fuzzig/crashes$ hexdump -C id:000000,sig:06,src:000699+000662,op:splice,rep:64
00000000  74 65 73 74 2f 00 00 00  00 00 00 00 00 00 00 00  |test/...........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000060  00 00 00 00 30 30 30 30  37 37 35 00 30 30 30 31  |....0000775.0001|
00000070  37 35 30 00 30 30 30 31  37 35 30 00 2b 30 30 30  |750.0001750.+000|
00000080  30 30 30 0d 32 30 30 00  31 34 31 36 32 32 00 30  |000.200.141622.0|
00000090  33 30 35 00 30 31 32 30  32 30 00 20 67 00 00 00  |305.012020. g...|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 30 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |.0..............|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 14  |................|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000f0  00 00 00 23 00 00 00 00  00 00 00 00 00 00 00 00  |...#............|
00000100  00 75 73 74 61 72 20 20  00 65 6e 74 72 6f 70 79  |.ustar  .entropy|
00000110  00 00 00 00 00 01 00 00  00 00 00 00 00 00 00 00  |................|
00000120  00 65 73 74 72 6f 70 79  00 00 00 00 00 00 00 00  |.estropy........|
00000130  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 bd 00 00  |................|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000200  20 00 00 00 00 00 00 e1  ff 00 00 00 00 00 00 00  | ...............|
00000210  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000230  00 06 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000240  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

Moe <entropy1337>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by entropy1337 (Submitted the item)
  • -email is unavailable- added by entropy1337
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-02-11 gray StatusNone Invalid
        Open/ClosedOpen Closed
    2022-01-29 entropy1337 Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code