Heap out of bounds read in _6502_op()

[fumfel]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu 18.04 x64
File format of the file you reverse (mandatory)	iNES ROM dump
Architecture/bits of the file (mandatory)	NES
r2 -v full output, not truncated (mandatory)	radare2 2.7.0-git 18328 @ linux-x86-64 git.2.6.0-153-g555e88a commit: 555e88a build: 2018-06-08__08:53:22

Expected behavior

Disassembly of file or error message.

Actual behavior

Heap out of bounds read in ASAN build.

Steps to reproduce the behavior

• Download https://github.com/radare/radare2-regressions/pull/1342
• Run: r2 -A r2_hoobr__6502_op

Additional Logs, screenshots, source-code, configuration dump, ...

==27952==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000015a40 at pc 0x7fa22785c5c2 bp 0x7ffd012164e0 sp 0x7ffd012164d0
READ of size 1 at 0x611000015a40 thread T0
    #0 0x7fa22785c5c1 in _6502_op XYZ/radare2/libr/..//libr/anal/p/anal_6502.c:685
    #1 0x7fa227b02d64 in r_anal_op XYZ/radare2/libr/anal/op.c:106
    #2 0x7fa22a3666cc in r_core_anal_search_xrefs XYZ/radare2/libr/core/canal.c:3122
    #3 0x7fa22a0a1931 in r_core_anal_refs XYZ/radare2/libr/core/cmd_anal.c:6277
    #4 0x7fa22a193763 in cmd_anal_all XYZ/radare2/libr/core/cmd_anal.c:6673
    #5 0x7fa22a193763 in cmd_anal XYZ/radare2/libr/core/cmd_anal.c:7023
    #6 0x7fa22a32e527 in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:237
    #7 0x7fa22a2164ae in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2700
    #8 0x7fa22a0ce3c0 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1753
    #9 0x7fa22a0d04c7 in r_core_cmd XYZ/radare2/libr/core/cmd.c:3402
    #10 0x562fe952360e in main XYZ/radare2/binr/radare2/radare2.c:1290
    #11 0x7fa22392682f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #12 0x562fe95283f8 in _start (/usr/local/bin/radare2+0x113f8)

0x611000015a40 is located 0 bytes to the right of 256-byte region [0x611000015940,0x611000015a40)
allocated by thread T0 here:
    #0 0x7fa22a8b4602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7fa22a366174 in r_core_anal_search_xrefs XYZ/radare2/libr/core/canal.c:3084

SUMMARY: AddressSanitizer: heap-buffer-overflow XYZ/radare2/libr/..//libr/anal/p/anal_6502.c:685 _6502_op
Shadow bytes around the buggy address:
  0x0c227fffaaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fffab00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fffab10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fffab20: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fffab30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fffab40: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
  0x0c227fffab50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fffab60: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c227fffab70: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fffab80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fffab90: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==27952==ABORTING