bugPSPP - Bugs: bug #67079, Heap Buffer Overflow in...

 
 

bug #67079: Heap Buffer Overflow in PSPP-Convert's rijndaelDecrypt Function

Submitter:  Nez <xu_dawn>
Submitted:  Sun 04 May 2025 05:33:17 AM UTC
   
 
Category:  None Severity:  5 - Average
Status:  None Assigned to:  None
Open/Closed:  Open Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 04 May 2025 05:33:17 AM UTC, original submission:  

Summary
Heap Buffer Overflow in PSPP-Convert's rijndaelDecrypt Function

Environment
PSPP version: master in Git Repository[commit:82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb]
OS: Ubuntu 20.04.6 LTS
Compiler: Clang-12.0.1


Steps to reproduce

# export CFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# export CXXFLAGS="-g -O0 -fno-inline -fno-lto -fsanitize=address"
# ./configure --prefix=$INSTALL_DIR --without-gui --disable-shared  --without-perl-module
# make -j64 & make install


root@9c4de30a2a30:# ./pspp-convert -O csv -p password -a abc -l 2 POC /dev/null
=================================================================
==4112733==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x618000000398 at pc 0x000000717c36 bp 0x7ffda52d85e0 sp 0x7ffda52d85d8
READ of size 4 at 0x618000000398 thread T0
    #0 0x717c35 in rijndaelDecrypt /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/gl/rijndael-alg-fst.c:1024:52
    #1 0x61b6d6 in fill_buffer /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/src/data/encrypted-file.c:439:5
    #2 0x61ae7b in encrypted_file_read /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/src/data/encrypted-file.c:152:11
    #3 0x4d26b4 in decrypt_file /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/utilities/pspp-convert.c:543:11
    #4 0x4d0d98 in main /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/utilities/pspp-convert.c:286:11
    #5 0x7fcd1c9aed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7fcd1c9aee3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #7 0x424034 in _start (/new-test/fuzzdir/fuz-pspp-convert/pspp-convert+0x424034)

0x618000000398 is located 0 bytes to the right of 792-byte region [0x618000000080,0x618000000398)
allocated by thread T0 here:
    #0 0x49eefd in malloc (/new-test/fuzzdir/fuz-pspp-convert/pspp-convert+0x49eefd)
    #1 0x619d16 in encrypted_file_open /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/src/data/encrypted-file.c:72:7
    #2 0x4d0cf9 in main /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/utilities/pspp-convert.c:284:7
    #3 0x7fcd1c9aed8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow /new-test/build-pspp/pspp-82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb/gl/rijndael-alg-fst.c:1024:52 in rijndaelDecrypt
Shadow bytes around the buggy address:
  0x0c307fff8020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c307fff8060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fff8070: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c307fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4112733==ABORTING

POC
https://drive.google.com/file/d/1qkQ1TlcMd3KNRpWlgw7UqzjHxt3AMK8G/view?usp=sharing



Credit
Xiaoguo Li (CUPL)
Xudong Cao (UCAS)

Nez <xu_dawn>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xu_dawn (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.15-26b0.
    Corresponding source code