To reproduce: yara yara_uaf_sized_string_cmp.yar strings
ASAN:
==18452==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000450 at pc 0x0000005ac75e bp 0x7fff366d71b0 sp 0x7fff366d71a8
READ of size 4 at 0x604000000450 thread T0
#0 0x5ac75d in sized_string_cmp XYZ/yara/libyara/sizedstr.c:39:14
#1 0x58cca4 in yr_execute_code XYZ/yara/libyara/exec.c:1096:21
#2 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
#3 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
#4 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
#5 0x4f6084 in main XYZ/yara/yara.c:1229:14
#6 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#7 0x41a7d8 in _start (/usr/local/bin/yara+0x41a7d8)
0x604000000450 is located 0 bytes inside of 44-byte region [0x604000000450,0x60400000047c)
freed by thread T0 here:
#0 0x4c23c2 in __interceptor_free (/usr/local/bin/yara+0x4c23c2)
#1 0x514c93 in yr_object_set_string XYZ/yara/libyara/object.c:1048:5
#2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
#3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
#4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
#5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
#6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
#7 0x4f6084 in main XYZ/yara/yara.c:1229:14
#8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
previously allocated by thread T0 here:
#0 0x4c26f3 in malloc (/usr/local/bin/yara+0x4c26f3)
#1 0x514cab in yr_object_set_string XYZ/yara/libyara/object.c:1052:41
#2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
#3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
#4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
#5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
#6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
#7 0x4f6084 in main XYZ/yara/yara.c:1229:14
#8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
SUMMARY: AddressSanitizer: heap-use-after-free XYZ/yara/libyara/sizedstr.c:39:14 in sized_string_cmp
Shadow bytes around the buggy address:
0x0c087fff8030: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x0c087fff8040: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
0x0c087fff8050: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff8060: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x0c087fff8070: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 01 fa
=>0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa[fd]fd fd fd fd fd
0x0c087fff8090: fa fa 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c087fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==18452==ABORTING
The text was updated successfully, but these errors were encountered:
Use-after-free in sized_string_cmp()
Git HEAD: eef165b
Payload
To reproduce:
yara yara_uaf_sized_string_cmp.yar stringsASAN:
The text was updated successfully, but these errors were encountered: