Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Out of bounds call to strlen in r_bin_dwarf_parse_ext_opcode #2684

Closed
hannob opened this issue Jun 2, 2015 · 0 comments
Closed

Out of bounds call to strlen in r_bin_dwarf_parse_ext_opcode #2684

hannob opened this issue Jun 2, 2015 · 0 comments
Labels

Comments

@hannob
Copy link

hannob commented Jun 2, 2015

An invalid elf file can cause an out of bounds memory access in the function r_bin_dwarf_parse_ext_opcode. Example file:
https://crashes.fuzzing-project.org/radare2-oob-heap-read-r_bin_dwarf_parse_ext_opcode

This was found with american fuzzy lop and can be seen with address sanitizer.

Address sanitizer output:

==29251==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d00000ccb7 at pc 0x7f0bd3090d70 bp 0x7fff1864df00 sp 0x7fff1864ded0
READ of size 18 at 0x60d00000ccb7 thread T0
    #0 0x7f0bd3090d6f in strlen (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x32d6f)
    #1 0x7f0bd19f567d in r_bin_dwarf_parse_ext_opcode /f/radare2/radare2/libr/bin/dwarf.c:463
    #2 0x7f0bd19f567d in r_bin_dwarf_parse_opcodes /f/radare2/radare2/libr/bin/dwarf.c:666
    #3 0x7f0bd19f567d in r_bin_dwarf_parse_line_raw2 /f/radare2/radare2/libr/bin/dwarf.c:717
    #4 0x7f0bd19fe346 in r_bin_dwarf_parse_line /f/radare2/radare2/libr/bin/dwarf.c:1533
    #5 0x7f0bd2aa46e2 in bin_dwarf /f/radare2/radare2/libr/core/bin.c:472
    #6 0x7f0bd2aa46e2 in r_core_bin_info /f/radare2/radare2/libr/core/bin.c:1656
    #7 0x7f0bd2aa691d in r_core_bin_set_env /f/radare2/radare2/libr/core/bin.c:101
    #8 0x7f0bd2a3db3e in r_core_file_do_load_for_io_plugin /f/radare2/radare2/libr/core/file.c:355
    #9 0x7f0bd2a3db3e in r_core_bin_load /f/radare2/radare2/libr/core/file.c:487
    #10 0x405a3d in main /f/radare2/radare2/binr/radare2/radare2.c:585
    #11 0x7f0bccf28f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
    #12 0x40a0dd (/mnt/ram/radare2/radare2+0x40a0dd)

0x60d00000ccb7 is located 0 bytes to the right of 135-byte region [0x60d00000cc30,0x60d00000ccb7)
allocated by thread T0 here:
    #0 0x7f0bd30b5855 in calloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x57855)
    #1 0x7f0bd19fe277 in r_bin_dwarf_parse_line /f/radare2/radare2/libr/bin/dwarf.c:1525

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strlen
Shadow bytes around the buggy address:
  0x0c1a7fff9940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff9980: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
=>0x0c1a7fff9990: 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa fa
  0x0c1a7fff99a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff99b0: 00 03 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
  0x0c1a7fff99c0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c1a7fff99d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff99e0: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==29251==ABORTING
@alvarofe alvarofe self-assigned this Jun 2, 2015
@jvoisin jvoisin added the fuzzing label Jun 3, 2015
alvarofe added a commit to alvarofe/radare2 that referenced this issue Jun 3, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants