PSPP - Bugs: bug #62986, heap-buffer-overflow in...

Group

Main
- Main
- View members
- Search
Homepage
Download
Docs
Mailing lists
Source code
Bugs
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Patches
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
News
- Browse
- Atom feed
- ~~Submit~~
- ~~Manage~~

bug #62986: heap-buffer-overflow in text_parse_counted_string

Submitter:	han zheng <kdsj>
Submitted:	Tue 30 Aug 2022 07:04:17 AM UTC


Category:	Other	Severity:	5 - Average
Status:	None	Assigned to:	None
Open/Closed:	Open	Release:	None
Effort:	0.00

* Mandatory Fields

Add a New Comment Rich Markup

Tue 30 Aug 2022 07:04:17 AM UTC, original submission:

## short summary
Hello, I was testing my fuzzer and find a heap buffer overflow in
text_parse_counted_string, pspp-1.6.2

## Environment
Ubuntu 21.10
gcc 11.2.0
pspp-1.6.2

## step to reproduce
./configure --disable-shared --without-gui && make -j$(nproc)
./pspp-dump-sav $POC

## ASan output

=================================================================
==2331314==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000021d at pc 0x0000004d775a bp 0x7fff3eb16760 sp 0x7fff3eb16758
READ of size 1 at 0x60200000021d thread T0
    #0 0x4d7759 in text_parse_counted_string /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav.c:1467:10
    #1 0x4d2adb in read_mrsets /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav.c:824:21
    #2 0x4d2adb in read_extension_record /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav.c:617:7
    #3 0x4d2adb in main /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav.c:219:15
    #4 0x7f88a8decfcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7f88a8ded07c in __libc_start_main csu/../csu/libc-start.c:409:3
    #6 0x41f384 in _start (/home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav+0x41f384)

0x60200000021d is located 0 bytes to the right of 13-byte region [0x602000000210,0x60200000021d)
allocated by thread T0 here:
    #0 0x49a24d in malloc /home/kdsj/workspace/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x4d9b05 in xmalloc /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/gl/xmalloc.c:44:19
    #2 0x7f88a8decfcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/kdsj/workspace/fuzz/verify/pspp-1.6.2/utilities/pspp-dump-sav.c:1467:10 in text_parse_counted_string
Shadow bytes around the buggy address:
0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c047fff8000: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x0c047fff8010: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x0c047fff8020: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
0x0c047fff8030: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
=>0x0c047fff8040: fa fa 00[05]fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable:           00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone:       fa
Freed heap region:       fd
Stack left redzone:      f1
Stack mid redzone:       f2
Stack right redzone:     f3
Stack after return:      f5
Stack use after scope:   f8
Global redzone:          f9
Global init order:       f6
Poisoned by user:        f7
Container overflow:      fc
Array cookie:            ac
Intra object redzone:    bb
ASan internal:           fe
Left alloca redzone:     ca
Right alloca redzone:    cb
Shadow gap:              cc
==2331314==ABORTING

## Credit
Han Zheng(NCNIPC of China, Hexhive)

han zheng <kdsj>

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:


Comment:

Attached Files

file #53635: poc3.zip added by kdsj (632B - application/x-zip-compressed)

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by jmd (Updated the item)

-email is unavailable- added by kdsj (Submitted the item)

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

Please enter the title of George Orwell's famous dystopian book (it's a date):

Follow 2 latest changes.

Date	Changed by	Updated Field	Previous Value	=>	Replaced by
2023-06-21	jmd	Category	None		Other
2022-08-30	kdsj	Attached File	-		Added poc3.zip, #53635

PSPP - Bugs: bug #62986, heap-buffer-overflow in...

bug #62986: heap-buffer-overflow in text_parse_counted_string

<a href="#postcomment">Post a Comment</a>

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#votes">Votes</a>

<a href="#history">History</a>