New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddressSanitizer: heap-buffer-overflow at libr/core/cmd_anal.c:1572 #12375

Closed
HongxuChen opened this Issue Dec 2, 2018 · 2 comments

Comments

Projects
None yet
2 participants
@HongxuChen
Copy link

HongxuChen commented Dec 2, 2018

Work environment

Questions Answers
OS/arch/bits (mandatory) Ubuntu x86 64
File format of the file you reverse (mandatory) ELF
Architecture/bits of the file (mandatory) arm/arm64
r2 -v full output, not truncated (mandatory) radare2 3.1.0 20265 @ linux-x86-64 git.3.1.0-46-g23a0cfcdd commit: 23a0cfc build: 2018-12-02__22:59:40

Expected behavior

r2 works normally

Actual behavior

r2 crashes

Steps to reproduce the behavior

  • run r2 $FILE and get into the REPL
  • run bd
  • run ao
$ r2 darko-arm/bin-arm/test2
 -- Greetings, human.
[0x000103bc]> bd
[0x000103bc]> ao
=================================================================
==8965==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200006e3d2 at pc 0x7ff57cb3ce14 bp 0x7ffe86aaadf0 sp 0x7ffe86aaade8
READ of size 1 at 0x60200006e3d2 thread T0
    #0 0x7ff57cb3ce13 in core_anal_bytes /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:1572:28
    #1 0x7ff57ca0321c in cmd_anal /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:5004:4
    #2 0x7ff57ccc4e8c in r_cmd_call /home/exp/FOT/radare2-fuzz/libr/core/cmd_api.c:235:10
    #3 0x7ff57cb06b75 in r_core_cmd_subst_i /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:2927:12
    #4 0x7ff57c9cd36f in r_core_cmd_subst /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:1936:9
    #5 0x7ff57c9bffad in r_core_cmd /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:3646:9
    #6 0x7ff57c98133d in r_core_prompt_exec /home/exp/FOT/radare2-fuzz/libr/core/core.c:2652:12
    #7 0x55ca3faa0831 in main /home/exp/FOT/radare2-fuzz/binr/radare2/radare2.c:1462:16
    #8 0x7ff57510ab96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x55ca3f9a2b09 in _start (/home/exp/FOT/radare2-fuzz/binr/radare2/radare2+0x23b09)

0x60200006e3d2 is located 0 bytes to the right of 2-byte region [0x60200006e3d0,0x60200006e3d2)
allocated by thread T0 here:
    #0 0x55ca3fa62e40 in realloc (/home/exp/FOT/radare2-fuzz/binr/radare2/radare2+0xe3e40)
    #1 0x7ff57c981843 in r_core_seek_size /home/exp/FOT/radare2-fuzz/libr/core/core.c:2694:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:1572:28 in core_anal_bytes
Shadow bytes around the buggy address:
  0x0c0480005c20: fa fa 04 fa fa fa fd fa fa fa 04 fa fa fa 04 fa
  0x0c0480005c30: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa fd fa
  0x0c0480005c40: fa fa 04 fa fa fa 04 fa fa fa fd fa fa fa 05 fa
  0x0c0480005c50: fa fa 05 fa fa fa fd fa fa fa 06 fa fa fa 06 fa
  0x0c0480005c60: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 03 fa
=>0x0c0480005c70: fa fa fd fa fa fa fd fa fa fa[02]fa fa fa fd fa
  0x0c0480005c80: fa fa 03 fa fa fa 03 fa fa fa 03 fa fa fa 03 fa
  0x0c0480005c90: fa fa 01 fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c0480005ca0: fa fa fd fa fa fa 03 fa fa fa 06 fa fa fa 03 fa
  0x0c0480005cb0: fa fa 04 fa fa fa fd fa fa fa 06 fa fa fa fd fa
  0x0c0480005cc0: fa fa 02 fa fa fa fd fa fa fa 02 fa fa fa 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8965==ABORTING
[1]    8965 abort      r2 darko-arm/bin-arm/test2

r2-bd-ao.zip

Additional Logs, screenshots, source-code, configuration dump, ...

The root cause seems to be bd. For other arch binaries such as x86_64, mips, ppc, it also works wrongly when bd is invoked firstly (below is a test against /bin/ls on Ubuntu x86_64).
2018-12-03-001325_603x357_scrot

@HongxuChen

This comment has been minimized.

Copy link

HongxuChen commented Dec 2, 2018

bd is not special, this also happens on b0, b$ where it's an invalid r2 command.

@HongxuChen

This comment has been minimized.

Copy link

HongxuChen commented Dec 2, 2018

We found that the crash happens when r2 is compiled with Clang -O3, the regular compilation does not emit a crash. Apparently these commands at least ruin the following ao results when it does not crash.
2018-12-03-010436_183x578_scrot

@radare radare added this to the 3.1.1 milestone Dec 3, 2018

radare added a commit that referenced this issue Dec 3, 2018

radare added a commit that referenced this issue Dec 3, 2018

@radare radare closed this in a1bc65c Dec 3, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment