New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Heap use-after-free in mrb_ary_ref #3547

Closed
clayton-shopify opened this Issue Mar 27, 2017 · 1 comment

Comments

Projects
None yet
2 participants
@clayton-shopify
Contributor

clayton-shopify commented Mar 27, 2017

The following input to mirb demonstrates a crash: 215447.txt

(Note that this input must be supplied to mirb, not mruby.)

ASAN report:

==5435==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200003fc50 at pc 0x00010fed42f8 bp 0x7fff501204f0 sp 0x7fff5011fca0
READ of size 16 at 0x60200003fc50 thread T0
    #0 0x10fed42f7 in __asan_memcpy (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d2f7)
    #1 0x10fad7894 in mrb_ary_ref array.c:552
    #2 0x10fae13f8 in mrb_ary_aget array.c:753
    #3 0x10fc3cca0 in mrb_vm_exec (mirb:x86_64+0x100170ca0)
    #4 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #5 0x10fc2b06e in mrb_run (mirb:x86_64+0x10015f06e)
    #6 0x10fc289b7 in mrb_funcall_with_block (mirb:x86_64+0x10015c9b7)
    #7 0x10fc25387 in mrb_funcall_argv (mirb:x86_64+0x100159387)
    #8 0x10fb76c02 in mrb_method_missing (mirb:x86_64+0x1000aac02)
    #9 0x10fc3bd45 in mrb_vm_exec (mirb:x86_64+0x10016fd45)
    #10 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #11 0x10face7f9 in main mirb.c:549
    #12 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

0x60200003fc50 is located 0 bytes inside of 16-byte region [0x60200003fc50,0x60200003fc60)
freed by thread T0 here:
    #0 0x10fedd356 in wrap_free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56356)
    #1 0x10fbc757b in mrb_default_allocf (mirb:x86_64+0x1000fb57b)
    #2 0x10fb4a519 in mrb_free gc.c:268
    #3 0x10fb4b4ea in obj_free gc.c:778
    #4 0x10fb5461b in incremental_sweep_phase gc.c:1030
    #5 0x10fb52ebc in incremental_gc gc.c:1096
    #6 0x10fb4ee86 in incremental_gc_until gc.c:1112
    #7 0x10fb4e19a in mrb_incremental_gc gc.c:1163
    #8 0x10fb4db18 in mrb_obj_alloc gc.c:507
    #9 0x10fad19c3 in ary_new_capa array.c:30
    #10 0x10fad231a in mrb_ary_new_from_values array.c:78
    #11 0x10fc5753f in mrb_vm_exec (mirb:x86_64+0x10018b53f)
    #12 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #13 0x10fc2b06e in mrb_run (mirb:x86_64+0x10015f06e)
    #14 0x10fc289b7 in mrb_funcall_with_block (mirb:x86_64+0x10015c9b7)
    #15 0x10fc25387 in mrb_funcall_argv (mirb:x86_64+0x100159387)
    #16 0x10fb76c02 in mrb_method_missing (mirb:x86_64+0x1000aac02)
    #17 0x10fc3bd45 in mrb_vm_exec (mirb:x86_64+0x10016fd45)
    #18 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #19 0x10face7f9 in main mirb.c:549
    #20 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

previously allocated by thread T0 here:
    #0 0x10fedd520 in wrap_realloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x56520)
    #1 0x10fbc7595 in mrb_default_allocf (mirb:x86_64+0x1000fb595)
    #2 0x10fb49238 in mrb_realloc_simple gc.c:201
    #3 0x10fb4991e in mrb_realloc gc.c:215
    #4 0x10fb4a3a3 in mrb_malloc gc.c:236
    #5 0x10fad19d4 in ary_new_capa array.c:31
    #6 0x10fad231a in mrb_ary_new_from_values array.c:78
    #7 0x10fc5753f in mrb_vm_exec (mirb:x86_64+0x10018b53f)
    #8 0x10fc32329 in mrb_vm_run (mirb:x86_64+0x100166329)
    #9 0x10face7f9 in main mirb.c:549
    #10 0x7fffbbbba234 in start (libdyld.dylib:x86_64+0x5234)

SUMMARY: AddressSanitizer: heap-use-after-free (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x4d2f7) in __asan_memcpy
Shadow bytes around the buggy address:
  0x1c0400007f30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x1c0400007f40: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x1c0400007f50: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fa
  0x1c0400007f60: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x1c0400007f70: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
=>0x1c0400007f80: fa fa fd fd fa fa fd fd fa fa[fd]fd fa fa fd fa
  0x1c0400007f90: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd
  0x1c0400007fa0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x1c0400007fb0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
  0x1c0400007fc0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x1c0400007fd0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5435==ABORTING
Abort trap: 6

This seems to happen because an array allocated on line 54 of the input gets garbage collected too soon.

This issue was reported by https://hackerone.com/ston3

@matz matz closed this in 6dabb33 Apr 3, 2017

matz added a commit that referenced this issue Apr 3, 2017

@clayton-shopify

This comment has been minimized.

Show comment
Hide comment
@clayton-shopify

clayton-shopify Apr 3, 2017

Contributor

@matz This issue needs to be re-opened since the change was reverted. The crash is still present in the latest master.

Contributor

clayton-shopify commented Apr 3, 2017

@matz This issue needs to be re-opened since the change was reverted. The crash is still present in the latest master.

@matz matz reopened this Apr 4, 2017

@matz matz closed this in 74712c7 Apr 5, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment