Use-after-free in symbols()

[fumfel]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu 18.04 x64
File format of the file you reverse (mandatory)	WASM
Architecture/bits of the file (mandatory)	N/A
r2 -v full output, not truncated (mandatory)	radare2 3.0.0-git 19358 @ linux-x86-64 git.2.9.0-9-g38d9170 commit: 38d9170 build: 2018-09-05__15:07:23

Expected behavior

Disassembly of file or error message.

Actual behavior

Use-after-free in ASAN build.

Steps to reproduce the behavior

• Download file: r2_uaf_symbols.zip
• Unpack and run radare with command: r2 -A r2_uaf_symbols

Additional Logs, screenshots, source-code, configuration dump, ...

==8161==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300002fcb0 at pc 0x7fe43eb3276a bp 0x7fff828bdd60 sp 0x7fff828bdd50
READ of size 8 at 0x60300002fcb0 thread T0
    #0 0x7fe43eb32769 in symbols XYZ/radare2/libr/..//libr/bin/p/bin_wasm.c:168
    #1 0x7fe43e794c00 in r_bin_object_set_items XYZ/radare2/libr/bin/obj.c:173
    #2 0x7fe43e7975a6 in r_bin_object_new XYZ/radare2/libr/bin/obj.c:95
    #3 0x7fe43e78f66f in r_bin_file_new_from_bytes XYZ/radare2/libr/bin/bfile.c:515
    #4 0x7fe43e75d811 in r_bin_load_io2 XYZ/radare2/libr/bin/bin.c:485
    #5 0x7fe43e75e411 in r_bin_load_io XYZ/radare2/libr/bin/bin.c:42
    #6 0x7fe43fc9386c in r_core_file_do_load_for_io_plugin XYZ/radare2/libr/core/cfile.c:385
    #7 0x7fe43fc9386c in r_core_bin_load XYZ/radare2/libr/core/cfile.c:543
    #8 0x55c1e7df930b in main XYZ/radare2/binr/radare2/radare2.c:1093
    #9 0x7fe43930a82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x55c1e7dfe9e8 in _start (/usr/local/bin/radare2+0x109e8)

0x60300002fcb0 is located 0 bytes inside of 32-byte region [0x60300002fcb0,0x60300002fcd0)
freed by thread T0 here:
    #0 0x7fe4403692ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
    #1 0x7fe43eb334d9 in entries XYZ/radare2/libr/..//libr/bin/p/bin_wasm.c:75

previously allocated by thread T0 here:
    #0 0x7fe44036979a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x7fe4399dcd07 in r_list_new XYZ/radare2/libr/util/list.c:155

SUMMARY: AddressSanitizer: heap-use-after-free XYZ/radare2/libr/..//libr/bin/p/bin_wasm.c:168 symbols
Shadow bytes around the buggy address:
  0x0c067fffdf40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffdf50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fffdf60: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c067fffdf70: fa fa 00 00 00 00 fa fa fd fd fd fd fa fa fd fd
  0x0c067fffdf80: fd fd fa fa fd fd fd fd fa fa 00 00 00 00 fa fa
=>0x0c067fffdf90: fd fd fd fd fa fa[fd]fd fd fd fa fa fd fd fd fd
  0x0c067fffdfa0: fa fa 00 00 00 00 fa fa fd fd fd fd fa fa 00 00
  0x0c067fffdfb0: 00 00 fa fa fd fd fd fd fa fa 00 00 00 fa fa fa
  0x0c067fffdfc0: 00 00 00 fa fa fa 00 00 00 00 fa fa fd fd fd fa
  0x0c067fffdfd0: fa fa fd fd fd fd fa fa 00 00 00 00 fa fa fd fd
  0x0c067fffdfe0: fd fd fa fa 00 00 00 00 fa fa fd fd fd fd fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==8161==ABORTING