==26982==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6180000117c0 at pc 0x559e00d26059 bp 0x7f01f18e9250 sp 0x7f01f18e9240
READ of size 8 at 0x6180000117c0 thread T4
#0 0x559e00d26058 in cherokee_services_client_spawn /home/mmm/fuzz/webserver/cherokee/services-client.c:201
#1 0x559e00d5dd3c in fork_and_execute_cgi_via_spawner /home/mmm/fuzz/webserver/cherokee/handler_cgi.c:802
#2 0x559e00d5a5a8 in cherokee_handler_cgi_init /home/mmm/fuzz/webserver/cherokee/handler_cgi.c:382
#3 0x559e00dd244c in cherokee_handler_init /home/mmm/fuzz/webserver/cherokee/handler.c:93
#4 0x559e00dcf233 in cherokee_connection_open_request /home/mmm/fuzz/webserver/cherokee/connection.c:2678
#5 0x559e00d0b889 in process_active_connections /home/mmm/fuzz/webserver/cherokee/thread.c:1165
#6 0x559e00d11549 in cherokee_thread_step_MULTI_THREAD /home/mmm/fuzz/webserver/cherokee/thread.c:2086
#7 0x559e00d05300 in thread_routine /home/mmm/fuzz/webserver/cherokee/thread.c:99
#8 0x7f01f69f46da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
#9 0x7f01f651988e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)
0x6180000117c0 is located 0 bytes to the right of 832-byte region [0x618000011480,0x6180000117c0)
allocated by thread T4 here:
#0 0x7f01f6f22b50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
#1 0x559e00d5908e in cherokee_handler_cgi_new /home/mmm/fuzz/webserver/cherokee/handler_cgi.c:124
#2 0x559e00dcd8b0 in cherokee_connection_create_handler /home/mmm/fuzz/webserver/cherokee/connection.c:2446
#3 0x559e00d0b1f1 in process_active_connections /home/mmm/fuzz/webserver/cherokee/thread.c:1104
#4 0x559e00d11549 in cherokee_thread_step_MULTI_THREAD /home/mmm/fuzz/webserver/cherokee/thread.c:2086
#5 0x559e00d05300 in thread_routine /home/mmm/fuzz/webserver/cherokee/thread.c:99
#6 0x7f01f69f46da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
Thread T4 created by T0 here:
#0 0x7f01f6e7bd2f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x37d2f)
#1 0x559e00d06219 in cherokee_thread_new /home/mmm/fuzz/webserver/cherokee/thread.c:247
#2 0x559e00cee73f in initialize_server_threads /home/mmm/fuzz/webserver/cherokee/server.c:671
#3 0x559e00cf0a05 in cherokee_server_initialize /home/mmm/fuzz/webserver/cherokee/server.c:1053
#4 0x559e00c9476f in common_server_initialization /home/mmm/fuzz/webserver/cherokee/main_worker.c:255
#5 0x559e00c951f7 in main /home/mmm/fuzz/webserver/cherokee/main_worker.c:393
#6 0x7f01f6419b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/mmm/fuzz/webserver/cherokee/services-client.c:201 in cherokee_services_client_spawn
Shadow bytes around the buggy address:
0x0c307fffa2a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c307fffa2b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c307fffa2c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c307fffa2d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c307fffa2e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c307fffa2f0: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
0x0c307fffa300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c307fffa310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c307fffa320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c307fffa330: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c307fffa340: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==26982==ABORTING
In my own test I end up with, which obviously is also something that should be fixed.
Thread 1 "cherokee-worker" received signal SIGSEGV, Segmentation fault.
0x00007ffff71d0452 in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5
(gdb) bt
#0 0x00007ffff71d0452 in ?? () from /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5
#1 0x00007ffff72b3f45 in free () from /usr/lib/gcc/x86_64-pc-linux-gnu/9.2.0/libasan.so.5
#2 0x0000555555711624 in cherokee_handler_cgi_free (cgi=0x618000005480) at handler_cgi.c:240
#3 0x000055555579a8e9 in cherokee_handler_free (hdl=0x618000005480) at handler.c:72
#4 0x0000555555788d03 in cherokee_connection_setup_error_handler (conn=0x61d000006e80) at connection.c:442
#5 0x00005555556c6505 in process_active_connections (thd=0x61300000d080) at thread.c:1276
#6 0x00005555556ca112 in cherokee_thread_step_SINGLE_THREAD (thd=0x61300000d080) at thread.c:1891
#7 0x00005555556abbf6 in cherokee_server_step (srv=0x617000000080) at server.c:1161
#8 0x0000555555651591 in main (argc=1, argv=0x7fffffffd978) at main_worker.c:407
In #1224 it was already pointed out that what issues arise when the number of headers exceed ENV_VAR_NUM.
It seems also be the root cause of issue #1225. In addition I guarantee that the envp list always ends with NULL, a required terminal.
* Address a memory leak
* Improve the CGI handler in case of header excess
In #1224 it was already pointed out that what issues arise when the number of headers exceed ENV_VAR_NUM. It seems also be the root cause of issue #1225. In addition I guarantee that the envp list always ends with NULL, a required terminal.
* Introduce a QA-test that would crash Cherokee if more than ENV_VAR_NUM are send in by a client towards Handler CGI.
Fix#1224 and #1225
PoC
ASAN
Setup:
mkdir /var/www/test{1..20}; for i inseq 1 20; do echo test > test$i/test.html; donefound by: Mateusz Kocielski, Michał Dardas from LogicalTrust
The text was updated successfully, but these errors were encountered: