bugGNU patch - Bugs: bug #56683, Double free in pch.c:1187

 
 

bug #56683: Double free in pch.c:1187

Submitter:  Manh-Dung Nguyen <strongcourage>
Submitted:  Sun 28 Jul 2019 07:01:53 AM UTC
   
 
Category:  Parser / Internal Representation Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 07 Dec 2022 11:45:17 AM UTC, comment #1: 

After the pointer is released, we need to clear the length and pointer.
Like this:

    while (p_end >= 0) {
        if (p_end == p_efake)
            p_end = p_bfake;            /* don't free twice */
        else {
            free(p_line[p_end]);
            p_line[p_end] = NULL;
            p_len[p_end] = 0;
        }
        p_end--;
    }

 yixiangzhike <yixiangzhike>
Sun 28 Jul 2019 07:01:53 AM UTC, original submission:  

Hi,

I found a double free in pch.c:1187 (the latest commit 76e7758 on master). This bug causes the program patch to crash.

PoC: https://github.com/strongcourage/PoCs/blob/master/patch_76e7758/PoC_df
Command: patch -Rf < $PoC

ASAN says:
==2576==ERROR: AddressSanitizer: attempting double-free on 0x60200000ed90 in thread T0:
    #0 0x7f237fe6832a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x414188 in another_hunk ../../src/pch.c:1187
    #2 0x406ce2 in main ../../src/patch.c:408
    #3 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #4 0x4037e8 in _start (/home/dungnguyen/PoCs/patch_76e7758/patch-asan+0x4037e8)

0x60200000ed90 is located 0 bytes inside of 4-byte region [0x60200000ed90,0x60200000ed94)
freed by thread T0 here:
    #0 0x7f237fe6832a in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9832a)
    #1 0x414188 in another_hunk ../../src/pch.c:1187
    #2 0x406ce2 in main ../../src/patch.c:408
    #3 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x7f237fe68662 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98662)
    #1 0x421b71 in savebuf ../../src/util.c:869
    #2 0x415595 in another_hunk ../../src/pch.c:1443
    #3 0x406ce2 in main ../../src/patch.c:408
    #4 0x7f237fa2682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

Thanks,
Manh Dung

 Manh-Dung Nguyen <strongcourage>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #54067:  Clear-the-length-and-pointer-after-the-pointer-is-released.patch added by yixiangzhike (2KiB - application/octet-stream - Patch for double free in pch.c)
file #47273:  PoC_df added by strongcourage (769B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yixiangzhike (Posted a comment)
  • -email is unavailable- added by agruen (Updated the item)
  • -email is unavailable- added by strongcourage (Submitted the item)
  • -email is unavailable- added by strongcourage

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-12-07 yixiangzhike Attached File- Added Clear-the-length-and-pointer-after-the-pointer-is-released.patch, #54067
    2019-07-28 agruen CategoryNone Parser / Internal Representation
    2019-07-28 strongcourage Attached File- Added PoC_df, #47273
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-c8cf.
    Corresponding source code