AddressSanitizer: heap-buffer-overflow at libr/core/cmd_anal.c:1572

[hongxuchen]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu x86 64
File format of the file you reverse (mandatory)	ELF
Architecture/bits of the file (mandatory)	arm/arm64
r2 -v full output, not truncated (mandatory)	radare2 3.1.0 20265 @ linux-x86-64 git.3.1.0-46-g23a0cfcdd commit: 23a0cfc build: 2018-12-02__22:59:40

Expected behavior

r2 works normally

Actual behavior

r2 crashes

Steps to reproduce the behavior

• run r2 $FILE and get into the REPL
• run bd
• run ao

$ r2 darko-arm/bin-arm/test2
 -- Greetings, human.
[0x000103bc]> bd
[0x000103bc]> ao
=================================================================
==8965==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200006e3d2 at pc 0x7ff57cb3ce14 bp 0x7ffe86aaadf0 sp 0x7ffe86aaade8
READ of size 1 at 0x60200006e3d2 thread T0
    #0 0x7ff57cb3ce13 in core_anal_bytes /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:1572:28
    #1 0x7ff57ca0321c in cmd_anal /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:5004:4
    #2 0x7ff57ccc4e8c in r_cmd_call /home/exp/FOT/radare2-fuzz/libr/core/cmd_api.c:235:10
    #3 0x7ff57cb06b75 in r_core_cmd_subst_i /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:2927:12
    #4 0x7ff57c9cd36f in r_core_cmd_subst /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:1936:9
    #5 0x7ff57c9bffad in r_core_cmd /home/exp/FOT/radare2-fuzz/libr/core/cmd.c:3646:9
    #6 0x7ff57c98133d in r_core_prompt_exec /home/exp/FOT/radare2-fuzz/libr/core/core.c:2652:12
    #7 0x55ca3faa0831 in main /home/exp/FOT/radare2-fuzz/binr/radare2/radare2.c:1462:16
    #8 0x7ff57510ab96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x55ca3f9a2b09 in _start (/home/exp/FOT/radare2-fuzz/binr/radare2/radare2+0x23b09)

0x60200006e3d2 is located 0 bytes to the right of 2-byte region [0x60200006e3d0,0x60200006e3d2)
allocated by thread T0 here:
    #0 0x55ca3fa62e40 in realloc (/home/exp/FOT/radare2-fuzz/binr/radare2/radare2+0xe3e40)
    #1 0x7ff57c981843 in r_core_seek_size /home/exp/FOT/radare2-fuzz/libr/core/core.c:2694:9

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/exp/FOT/radare2-fuzz/libr/core/./cmd_anal.c:1572:28 in core_anal_bytes
Shadow bytes around the buggy address:
  0x0c0480005c20: fa fa 04 fa fa fa fd fa fa fa 04 fa fa fa 04 fa
  0x0c0480005c30: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa fd fa
  0x0c0480005c40: fa fa 04 fa fa fa 04 fa fa fa fd fa fa fa 05 fa
  0x0c0480005c50: fa fa 05 fa fa fa fd fa fa fa 06 fa fa fa 06 fa
  0x0c0480005c60: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 03 fa
=>0x0c0480005c70: fa fa fd fa fa fa fd fa fa fa[02]fa fa fa fd fa
  0x0c0480005c80: fa fa 03 fa fa fa 03 fa fa fa 03 fa fa fa 03 fa
  0x0c0480005c90: fa fa 01 fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c0480005ca0: fa fa fd fa fa fa 03 fa fa fa 06 fa fa fa 03 fa
  0x0c0480005cb0: fa fa 04 fa fa fa fd fa fa fa 06 fa fa fa fd fa
  0x0c0480005cc0: fa fa 02 fa fa fa fd fa fa fa 02 fa fa fa 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8965==ABORTING
[1]    8965 abort      r2 darko-arm/bin-arm/test2

r2-bd-ao.zip

Additional Logs, screenshots, source-code, configuration dump, ...

The root cause seems to be bd. For other arch binaries such as x86_64, mips, ppc, it also works wrongly when bd is invoked firstly (below is a test against /bin/ls on Ubuntu x86_64).

[hongxuchen]

bd is not special, this also happens on b0, b$ where it's an invalid r2 command.

[hongxuchen]

We found that the crash happens when r2 is compiled with Clang -O3, the regular compilation does not emit a crash. Apparently these commands at least ruin the following ao results when it does not crash.