Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug report on libhtp( AddressSanitizer: SEGV) #342

Closed
afosscontact opened this issue Dec 23, 2021 · 6 comments
Closed

Bug report on libhtp( AddressSanitizer: SEGV) #342

afosscontact opened this issue Dec 23, 2021 · 6 comments

Comments

@afosscontact
Copy link

afosscontact commented Dec 23, 2021

Describe the bug
A bug was found within the libhtp. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using libhtp. It would be best if the affected logic is checked beforehand.
The bug was found with a fuzzer based on the function "Utf8.SingleByte".
This may cause problems in the use of libraries

How To Reproduce

  1. Download the attached file
  2. Execute make_libhtp_bug1.sh
  3. ./test_all --gtest_filter=Utf8.SingleByte

=================================================================
==6613==ERROR: AddressSanitizer: SEGV on unknown address 0x00009f33a90c (pc 0x000000818140 bp 0x7ffe542fc530 sp 0x7ffe542fc4f0 T0)
==6613==The signal is caused by a READ memory access.
#0 0x818140 in htp_utf8_decode libhtp/htp/htp_utf8_decoder.c:109:19
#1 0x6dbe3a in Utf8_SingleByte_Test::TestBody() libhtp/test/test_utils.cpp

Platform (please complete the following information):
OS: Ubuntu 18.04

libhtp_bug1.tar.gz

@catenacyber
Copy link
Contributor

Thanks @afosscontact for this report.

Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using assimp

What is assimp ?

The bug was found with a fuzzer based on the function "Utf8.SingleByte".

The function htp_utf8_decode (except by this test ) is never used and could indeed be removed...

@afosscontact
Copy link
Author

afosscontact commented Dec 23, 2021

I was sorry.
Project Name was wrong
I modified

@autofuzzoss
Copy link

Thank you for the fast fix
This bug found in Fuzzing technology we are studying
If you have completed the modification for this bug, I want to issue CVE ID
Is it possible to issue CVE ID?

@autofuzzoss
Copy link

If you are enabled, you want to be issued under the name Autofuzz.
Because I am being issued as a NickName called Autofuzz in CVEs found by this Fuzzing technology.

@catenacyber
Copy link
Contributor

@junsik-kim0 are you a bot ?
How is this relevant for a CVE ?
It is dead/unreachable code...

@catenacyber
Copy link
Contributor

Fixed by #344

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging a pull request may close this issue.

3 participants