bugGNU patch - Bugs: bug #53133, double free in another_hunk()


bug #53133: double free in another_hunk()

Submitter:  Hanno Boeck <hanno>
Submitted:  Mon 12 Feb 2018 09:12:29 PM UTC
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup

Jump to the original submission

Tue 21 Aug 2018 11:55:37 AM UTC, comment #7: 

This bug has been assigned CVE number CVE-2018-6952.

Andreas Gruenbacher <agruen>
Group administrator
Tue 21 Aug 2018 07:52:47 AM UTC, comment #6: 

That's an unfortunate interaction between libattr and libasan, and has nothing to do with patch itself.  I've added a workaround to libattr:

  commit 14adc898  Switch back to syscall()

Andreas Gruenbacher <agruen>
Group administrator
Tue 21 Aug 2018 07:07:36 AM UTC, comment #5: 

While there's no longer a double free, instead patch now crashes with a recursive stack overflow on the same input.

That's... not much better.

==10621==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd20b267f8 (pc 0x00000047d3e8 bp 0x7ffd20b27070 sp 0x7ffd20b26800 T0)
    #0 0x47d3e7 in __interceptor_llistxattr (/r/patch/patch+0x47d3e7)
    #1 0x47d697 in __interceptor_llistxattr (/r/patch/patch+0x47d697)
    #2 0x47d697 in __interceptor_llistxattr (/r/patch/patch+0x47d697)
    #3 0x47d697 in __interceptor_llistxattr (/r/patch/patch+0x47d697)

Hanno Boeck <hanno>
Fri 17 Aug 2018 02:48:16 PM UTC, comment #4: 

Fixed in commit 9c986353e4.

Andreas Gruenbacher <agruen>
Group administrator
Wed 18 Apr 2018 02:24:59 PM UTC, comment #3: 

Any progress on this?

Jean Delvare <khali>
Thu 15 Feb 2018 03:16:58 PM UTC, comment #2: 

An empty file will do.

I could trace the double-free down to the first free in another_hunk in line 1185.  Something seems to be going wrong with swapping around p_bfake / p_efake in pch_swap; the second swap doesn't restore the original values.  I couldn't figure out what's wrong exactly, though.

Andreas Gruenbacher <agruen>
Group administrator
Thu 15 Feb 2018 03:07:59 PM UTC, comment #1: 

In order to reproduce the bug, it would help to also have the file to which the patch is being tentatively applied.

Jean Delvare <khali>
Mon 12 Feb 2018 09:12:29 PM UTC, original submission:  

The attached file causes a double free. This can be seen by compiling patch (current git, f290f48a621867084884bfff87f8093c15195e6a) with Address Sanitizer (-fsanitize=address in CFLAGS).

This was found with afl.

Stack trace:
==6258==ERROR: AddressSanitizer: attempting double-free on 0x602000000170 in thread T0:
    #0 0x4da310 in __interceptor_free.localalias.0 (/r/patch/patch+0x4da310)
    #1 0x530182 in another_hunk /f/patch/patch/src/pch.c:1185:6
    #2 0x52152e in main /f/patch/patch/src/patch.c:396:25
    #3 0x7f3f98ed7f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)
    #4 0x41b139 in _start (/r/patch/patch+0x41b139)

0x602000000170 is located 0 bytes inside of 2-byte region [0x602000000170,0x602000000172)
freed by thread T0 here:
    #0 0x4da310 in __interceptor_free.localalias.0 (/r/patch/patch+0x4da310)
    #1 0x530182 in another_hunk /f/patch/patch/src/pch.c:1185:6
    #2 0x52152e in main /f/patch/patch/src/patch.c:396:25
    #3 0x7f3f98ed7f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)

previously allocated by thread T0 here:
    #0 0x4da4f0 in malloc (/r/patch/patch+0x4da4f0)
    #1 0x5496f1 in savebuf /f/patch/patch/src/util.c:861:8
    #2 0x51e614 in main /f/patch/patch/src/patch.c:396:25
    #3 0x7f3f98ed7f85 in __libc_start_main (/lib64/libc.so.6+0x20f85)

Hanno Boeck <hanno>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by agruen (Posted a comment)
  • -email is unavailable- added by khali (Posted a comment)
  • -email is unavailable- added by khali
  • -email is unavailable- added by hanno (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-08-17 agruen StatusNone Fixed
        Open/ClosedOpen Closed
    2018-02-14 khali Carbon-Copy- Added khali
    2018-02-12 hanno Attached File- Added doublefree-another_hunk.patch, #43264

    Back to the top

    Powered by Savane 3.13-12ab.
    Corresponding source code