mainThe oSIP library - Support: sr #109133, Heap buffer overflow in utility...

 
 

sr #109133: Heap buffer overflow in utility function *osip_clrncpy* in libosip2-4.1.0

Submitter:  Bhargava Shastry <bshastry>
Submitted:  Fri 02 Sep 2016 09:03:31 PM UTC
   
 
Category:  None Priority:  3 - Low
Severity:  3 - Normal Status:  In Progress
Privacy:  Public Assigned to:  aymeric
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 19 Mar 2018 10:34:05 AM UTC, comment #3: 

It's unfortunate but I don't have any copy of the attachement. I guess the problem is on savannah and hope it's temporary.
Aymeric

Aymeric MOIZARD <aymeric>
Group administrator
Sun 18 Mar 2018 05:11:40 PM UTC, comment #2: 

Hi,
The sip message file #38415 is unavailable ...
link is broken. Any chance someone can fix the link?
Upload the file? Thanks

Oren <orenosip>
Mon 05 Sep 2016 03:01:46 PM UTC, comment #1: 

fixed in git commit 7e0793e15e21f68337e130c67b031ca38edf055f.
Tks a lot for report.

Aymeric MOIZARD <aymeric>
Group administrator
Fri 02 Sep 2016 09:03:31 PM UTC, original submission:  

Hi, While fuzzing the torture_test application, I discovered the following bug using afl-fuzz, AddressSanitizer and the patch using an in-house crash triage tool called Orthrus.

Steps to reproduce



$ CFLAGS="-fsanitize=address" LDFLAGS="-fsanitize=address" ./configure --enable-test --disable-shared
$ make -j
$ ./src/test/torture_test <ATTACHED_INPUT> 0 -c


Attached input filename starts with ASAN

Bug


I had a hard time reducing this test case. Sadly, with the attached input, it is hard to see the problem because the buggy function is called way too often with valid inputs before the problematic corner case.

Essentially, the bailing out here:


if (src == NULL)
  return NULL;


should also take into account zero length strings.

Fix


The attached patch (filename 0001...) fixes this bug by adding the missing sanitization.

Security considerations


This bug does not impact an non-instrumented version of libosip2 i.e., deployed code. Thus, it does not abort in production and may not lead to a denial of service. So, treating this as a normal bug.

Reporter


  • Bhargava Shastry, SecT, TU Berlin
Bhargava Shastry <bshastry>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38415:  ASAN:2842033635,SESSION002:id:000084,sig:11,src:004194,op:havoc,rep:16 added by bshastry (4KiB - application/octet-stream - Crashing input and suggested patch)
file #38416:  0001-Patch-3-Fixes-heap-buffer-overflow-in-osip_clrncpy.patch added by bshastry (507B - text/x-patch - Crashing input and suggested patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by orenosip (Posted a comment)
  • -email is unavailable- added by aymeric (Updated the item)
  • -email is unavailable- added by bshastry (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-05 aymeric Open/ClosedOpen Closed
    2016-09-03 aymeric Priority5 - Normal 3 - Low
        StatusNone In Progress
        Assigned toNone aymeric
        Operating SystemGNU/Linux None
    2016-09-02 bshastry Attached File- Added ASAN:2842033635,SESSION002:id:000084,sig:11,src:004194,op:havoc,rep:16, #38415
        Attached File- Added 0001-Patch-3-Fixes-heap-buffer-overflow-in-osip_clrncpy.patch, #38416

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code