New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Heap use-after-free still exists in the bit_copy_chain #497
Comments
|
I think I found some thinkos in the obj_flush_hdlstream logic |
rurban
added a commit
that referenced
this issue
Aug 15, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Aug 15, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Sep 5, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Oct 16, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Nov 25, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 1, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 11, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 12, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 12, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 12, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 12, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 13, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 14, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 14, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 15, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
This was referenced Dec 15, 2022
rurban
added a commit
that referenced
this issue
Dec 15, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 16, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's)
rurban
added a commit
that referenced
this issue
Dec 16, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 17, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 17, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 19, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 20, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 25, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Dec 26, 2022
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 26, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 26, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 26, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 27, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 27, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 29, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
Apr 29, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 2, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 4, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 4, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 5, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 5, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 7, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 7, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 7, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 7, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 8, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 8, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 10, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 10, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 11, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 11, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 11, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 12, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 12, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 13, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 13, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 17, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 17, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
rurban
added a commit
that referenced
this issue
May 19, 2023
don't free non-temp hdl_dat chain, when it's the dat->chain really. (on old DWG's) TODO dwgadd still broken
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Vulnerability description
version: 0.12.4.4608 & latest commit f2dea29
poc: poc
command: ./dwgrewrite poc
This is similar to issue #364 and others, but it seems that the patch e95cc1e has not fully fixed them.
Here is the trace reported by ASAN:
Vulnerability analysis
When running to
bit_copy_chain, bothdat->chainandtmp_dat->chainpoint to0x7ffff3b65800(see the gdb output below).This will lead to use-after-free, since line 3339 calls
realloc, which frees the chunk0x7ffff3b65800, and line 3352 ties to read from the freed chunk.Also note that the comment says
bit_copy_chainCopy the whole content of tmp_data to dat, and reset tmp_dat, so whydat->chain = tmp_dat->chainin this PoC should be further investigated.libredwg/src/bits.c
Lines 3333 to 3360 in f2dea29
The text was updated successfully, but these errors were encountered: