bugGNU gettext - Bugs: bug #45391, Out of bounds read in xgettext on...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45391: Out of bounds read in xgettext on malformed input

Submitter:  Hanno Boeck <hanno>
Submitted:  Wed 24 Jun 2015 01:17:28 PM UTC
   
 
Category:  Programmer tools Severity:  3 - Normal
Item Group:  None Status:  Fix Released
Privacy:  Public Assigned to:  ueno
Open/Closed:  Closed

Jump to the original submission

Fri 26 Jun 2015 02:54:02 AM UTC, comment #7: 

Thanks for confirming.

Daiki Ueno <ueno>
Group administrator
Thu 25 Jun 2015 03:11:16 PM UTC, comment #6: 

yes, fixed now, you can close the bug

Hanno Boeck <hanno>
Thu 25 Jun 2015 12:05:47 PM UTC, comment #5: 

Ugh, the fix was immature.  I think it should be fixed now with:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=11ad7fcdb858c83d7aed5245761f2bc6f856980d

Daiki Ueno <ueno>
Group administrator
Thu 25 Jun 2015 09:06:34 AM UTC, comment #4: 

I still get the same error on the second input. (file content 'gettext("\x').

Hanno Boeck <hanno>
Thu 25 Jun 2015 02:50:19 AM UTC, comment #3: 

Right, thanks for your carefulness.

I've simplified the loop invariant to work out possible variants:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=4dd7d3dbcb2ec6ceae3a65d405751729fd26e1e1

Daiki Ueno <ueno>
Group administrator
Wed 24 Jun 2015 02:51:42 PM UTC, comment #2: 

It fixes the first input, but a small variant of it still causes an oob, see attachment. Instead of a zero byte and a newline it has an x after the \:
gettext("\x

(file #34306)

Hanno Boeck <hanno>
Wed 24 Jun 2015 02:30:38 PM UTC, comment #1: 

Thanks for the report.  I've committed a fix:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=8d235255

I think this is enough since gettext doesn't accept NUL character in translatable strings, but let me know if it is not the case.

Daiki Ueno <ueno>
Group administrator
Wed 24 Jun 2015 01:17:28 PM UTC, original submission:  

The attached file will cause an out of bounds heap read access in xgettext. Found with american fuzzy lop. This can be detected with either address sanitizer or valgrind.

Address Sanitizer trace:
```
==29054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000c6b2 at pc 0x0000004fad7e bp 0x7fff2b6eb190 sp 0x7fff2b6eb188
READ of size 1 at 0x60200000c6b2 thread T0
    #0 0x4fad7d in literalstring_parse /f/gettext-0.19.4/gettext-tools/src/x-c.c:887:20
    #1 0x4f518b in arglist_parser_done /f/gettext-0.19.4/gettext-tools/src/xgettext.c:3099:31
    #2 0x4ff01b in extract_parenthesized /f/gettext-0.19.4/gettext-tools/src/x-c.c:2111:11
    #3 0x4fde0c in extract_parenthesized /f/gettext-0.19.4/gettext-tools/src/x-c.c:2016:15
    #4 0x4fcc35 in extract_whole_file /f/gettext-0.19.4/gettext-tools/src/x-c.c:2144:11
    #5 0x4fae27 in extract_c /f/gettext-0.19.4/gettext-tools/src/x-c.c:2163:3
    #6 0x4e93dd in extract_from_file /f/gettext-0.19.4/gettext-tools/src/xgettext.c:2043:3
    #7 0x4e5e6c in main /f/gettext-0.19.4/gettext-tools/src/xgettext.c:818:7
    #8 0x7fc9d5a8af9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289
    #9 0x43cfa6 in _start (/mnt/ram/gettext/xgettext+0x43cfa6)

0x60200000c6b2 is located 0 bytes to the right of 2-byte region [0x60200000c6b0,0x60200000c6b2)
allocated by thread T0 here:
    #0 0x4c3f72 in malloc (/mnt/ram/gettext/xgettext+0x4c3f72)
    #1 0x68ed0a in xmalloc /f/gettext-0.19.4/gettext-tools/gnulib-lib/xmalloc.c:64:7
    #2 0x7fff2b6eb67f  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /f/gettext-0.19.4/gettext-tools/src/x-c.c:887 literalstring_parse
Shadow bytes around the buggy address:
  0x0c047fff9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff98a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff98b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff98c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff98d0: fa fa 00 02 fa fa[02]fa fa fa fd fa fa fa 00 02
  0x0c047fff98e0: fa fa 00 07 fa fa fd fd fa fa 00 00 fa fa 00 fa
  0x0c047fff98f0: fa fa 00 04 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff9900: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff9910: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
  0x0c047fff9920: fa fa 00 00 fa fa 00 00 fa fa 00 00 fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29054==ABORTING

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #34306:  xgettext-oob-heap-literalstring_parse-2.c added by hanno (12B - text/x-csrc - variant of heap oob sample)
file #34305:  xgettext-oob-heap-literalstring_parse.c added by hanno (12B - text/x-csrc - sample file triggering out of bounds heap access)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by haible (Updated the item)
  • -email is unavailable- added by ueno (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-01-04 haible StatusFixed Fix Released
    2016-11-27 haible CategoryNone Programmer tools
        Assigned toNone ueno
    2015-06-26 ueno StatusNone Fixed
        Open/ClosedOpen Closed
    2015-06-24 hanno Attached File- Added xgettext-oob-heap-literalstring_parse-2.c, #34306
    2015-06-24 hanno Attached File- Added xgettext-oob-heap-literalstring_parse.c, #34305

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code