mainThe GNU Bourne-Again SHell - Support: sr #108884, null ptr deref & segafault

 
 

sr #108884: null ptr deref & segafault

Submitter:  Brian Carpenter <geeknik>
Submitted:  Thu 17 Sep 2015 02:33:41 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 31 Jan 2017 06:57:02 PM UTC, comment #3: 

This has been marked as Done for a while. It was discussed on the mailing list cited here.  I am therefore closing the ticket.

http://lists.gnu.org/archive/html/bug-bash/2017-01/msg00048.html


Bob Proulx <rwp>
Group Member
Thu 17 Sep 2015 02:49:22 AM UTC, comment #2: 

It also affects the following:
4.3.39(0)-release on FreeBSD 9.3-RELEASE-p9

Brian Carpenter <geeknik>
Thu 17 Sep 2015 02:39:28 AM UTC, comment #1: 

This also appears to affect the following versions:
4.2.37(1)-release on Debian (x86_64)
4.3.39(1)-release on Red Hat (x86_64)

Brian Carpenter <geeknik>
Thu 17 Sep 2015 02:33:41 AM UTC, original submission:  

While fuzzing GNU bash, version 4.3.42(1)-release (x86_64-unknown-linux-gnu), I stumbled upon a 'script that triggers a null ptr deref and causes a segfault.

OS: Debian 7 (3.2.68-1+deb7u3 x86_64)
libc: 2.13-38+deb7u8
gcc: 4.92

Script:
<<$(()())|>_[$($(<<0))

(I'm not a bash scripter, so if this is expected behavior, I apologize for the report.)

Valgrind:
test00-min: line 2: warning: here-document at line 2 delimited by end-of-file (wanted `0')
test00-min: line 1: make_here_document: bad instruction type -808464433
==57557== Invalid read of size 1
==57557==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==57557==    by 0x482030: cprintf (print_cmd.c:1492)
==57557==    by 0x482C21: print_heredoc_header (print_cmd.c:1090)
==57557==    by 0x482C21: print_redirection (print_cmd.c:1162)
==57557==    by 0x48565F: print_heredocs (print_cmd.c:970)
==57557==    by 0x48565F: print_redirection_list (print_cmd.c:1062)
==57557==    by 0x49F6E9: execute_simple_command (execute_cmd.c:3892)
==57557==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==57557==    by 0x41F302: execute_pipeline (execute_cmd.c:2344)
==57557==    by 0x4AED96: execute_connection (execute_cmd.c:2508)
==57557==    by 0x4AED96: execute_command_internal (execute_cmd.c:945)
==57557==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==57557==    by 0x42E41F: reader_loop (eval.c:160)
==57557==    by 0x426566: main (shell.c:756)
==57557==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==57557==
==57557==
==57557== Process terminating with default action of signal 11 (SIGSEGV)
==57557==  Access not within mapped region at address 0x0
==57557==    at 0x4C29B72: __strlen_sse42 (vg_replace_strmem.c:424)
==57557==    by 0x482030: cprintf (print_cmd.c:1492)
==57557==    by 0x482C21: print_heredoc_header (print_cmd.c:1090)
==57557==    by 0x482C21: print_redirection (print_cmd.c:1162)
==57557==    by 0x48565F: print_heredocs (print_cmd.c:970)
==57557==    by 0x48565F: print_redirection_list (print_cmd.c:1062)
==57557==    by 0x49F6E9: execute_simple_command (execute_cmd.c:3892)
==57557==    by 0x4AABD7: execute_command_internal (execute_cmd.c:787)
==57557==    by 0x41F302: execute_pipeline (execute_cmd.c:2344)
==57557==    by 0x4AED96: execute_connection (execute_cmd.c:2508)
==57557==    by 0x4AED96: execute_command_internal (execute_cmd.c:945)
==57557==    by 0x4B2C7C: execute_command (execute_cmd.c:390)
==57557==    by 0x42E41F: reader_loop (eval.c:160)
==57557==    by 0x426566: main (shell.c:756)
==57557==  If you believe this happened as a result of a stack
==57557==  overflow in your program's main thread (unlikely but
==57557==  possible), you can try to increase the size of the
==57557==  main thread stack using the --main-stacksize= flag.
==57557==  The main thread stack size used in this run was 8388608.
Segmentation fault

GDB:
Starting program: /home/geeknik/bash/bash test00-min
test00-min: line 2: warning: here-document at line 2 delimited by end-of-file (wanted `0')
test00-min: line 1: make_here_document: bad instruction type -808464433

Program received signal SIGSEGV, Segmentation fault.
__strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
32 ../sysdeps/x86_64/multiarch/strlen-sse4.S: No such file or directory.
(gdb) bt
#0  __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1  0x0000000000482031 in cprintf ()
#2  0x0000000000482c22 in print_redirection ()
#3  0x0000000000485660 in print_redirection_list ()
#4  0x000000000049f6ea in execute_simple_command () at execute_cmd.c:3892
#5  0x00000000004aabd8 in execute_command_internal () at execute_cmd.c:787
#6  0x000000000041f303 in execute_pipeline () at execute_cmd.c:2344
#7  0x00000000004aed97 in execute_command_internal () at execute_cmd.c:2508
#8  0x00000000004b2c7d in execute_command () at execute_cmd.c:390
#9  0x000000000042e420 in reader_loop ()
#10 0x0000000000426567 in main () at shell.c:756
(gdb) i r
rax            0x0 0
rbx            0x868436 8815670
rcx            0x0 0
rdx            0x2480 9344
rsi            0x7fffffffdbf1 140737488346097
rdi            0x0 0
rbp            0x18 0x18
rsp            0x7fffffffdbc8 0x7fffffffdbc8
r8             0x0 0
r9             0x2 2
r10            0xaca788 11315080
r11            0x7ffff777a730 140737345201968
r12            0x73 115
r13            0x0 0
r14            0x1 1
r15            0x0 0
rip            0x7ffff773f8cf 0x7ffff773f8cf <__strlen_sse42+15>
eflags         0x10246 [ PF ZF IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0

Brian Carpenter <geeknik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by chet (Updated the item)
  • -email is unavailable- added by geeknik (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-01-31 rwp Open/ClosedOpen Closed
    2015-11-13 chet StatusNone Done

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code