Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

invalid memory read in lzo1x_decompress (lzo1x_d.ch) #68

Closed
asarubbo opened this issue Mar 24, 2017 · 9 comments
Closed

invalid memory read in lzo1x_decompress (lzo1x_d.ch) #68

asarubbo opened this issue Mar 24, 2017 · 9 comments

Comments

@asarubbo
Copy link

On 0.631:

# lrzip -t $FILE
Decompressing...
Failed to decompress buffer - lzmaerr=6
ASAN:DEADLYSIGNAL
=================================================================
==3311==ERROR: AddressSanitizer: SEGV on unknown address 0x602000010000 (pc 0x7f75cabe8834 bp 0x62100002c11f sp 0x7f7085ab4d78 T5)
==3311==The signal is caused by a READ memory access.
    #0 0x7f75cabe8833 in lzo1x_decompress /tmp/portage/dev-libs/lzo-2.08/work/lzo-2.08/src/lzo1x_d.ch:108
    #1 0x54af2f in lzo_decompress_buf /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/stream.c:590:10
    #2 0x54af2f in ucompthread /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/stream.c:1525
    #3 0x7f75ca2944a3 in start_thread /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/nptl/pthread_create.c:333
    #4 0x7f75c95bf66c in clone /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:109

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/dev-libs/lzo-2.08/work/lzo-2.08/src/lzo1x_d.ch:108 in lzo1x_decompress
Thread T5 created by T0 here:
    #0 0x42d49d in pthread_create /tmp/portage/sys-devel/llvm-3.9.1-r1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:245
    #1 0x53e70f in create_pthread /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/stream.c:133:6
    #2 0x53e70f in fill_buffer /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/stream.c:1673
    #3 0x53e70f in read_stream /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/stream.c:1755
    #4 0x531075 in unzip_literal /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/runzip.c:162:16
    #5 0x531075 in runzip_chunk /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/runzip.c:320
    #6 0x531075 in runzip_fd /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/runzip.c:382
    #7 0x519b41 in decompress_file /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/lrzip.c:826:6
    #8 0x511074 in main /tmp/portage/app-arch/lrzip-0.631/work/lrzip-0.631/main.c:669:4
    #9 0x7f75c94f878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289

Dunno wtf decompression type to use!
==3311==AddressSanitizer: while reporting a bug found another one. Ignoring.
Fatal error - exiting

Reproducer:
https://github.com/asarubbo/poc/blob/master/00230-lrzip-invalidread-lzo1x_decompress

@asarubbo
Copy link
Author

I guess the failure happens in lzo_decompress_buf

@ppisar
Copy link

ppisar commented May 9, 2017

@ariccio
Copy link

ariccio commented May 12, 2017

Error -6 is LZO_E_LOOKBEHIND_OVERRUN.

@lamby
Copy link

lamby commented May 20, 2017

Is there an upstream-blessed patch yet? :)

@ckolivas
Copy link
Owner

I don't have time to look at any of these at the moment I'm afraid. One day...

@lamby
Copy link

lamby commented May 22, 2017

Can't seem to reproduce with lzop:

$ file ~/Downloads/00230-lrzip-invalidread-lzo1x_decompress.lzo   
/home/lamby/Downloads/00230-lrzip-invalidread-lzo1x_decompress.lzo: LRZIP compressed data - version 0.6

$ lzop -d ~/Downloads/00230-lrzip-invalidread-lzo1x_decompress.lzo
lzop: /home/lamby/Downloads/00230-lrzip-invalidread-lzo1x_decompress.lzo: not a lzop file

@ckolivas
Copy link
Owner

Fixed.

@lamby
Copy link

lamby commented May 16, 2018

@ckolivas Thanks. Which commit was this fixed in? I see a bunch of semi-related ones.. :)

@ckolivas
Copy link
Owner

89d7b33

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants