Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stack buffer overflow in r_hex_bin2str() #8673

Closed
fumfel opened this issue Oct 11, 2017 · 1 comment
Closed

Stack buffer overflow in r_hex_bin2str() #8673

fumfel opened this issue Oct 11, 2017 · 1 comment

Comments

@fumfel
Copy link

fumfel commented Oct 11, 2017

Stack buffer overflow in r_hex_bin2str()

Git HEAD: 467415c

Faulting file in https://github.com/radare/radare2-regressions/pull/1054

Command: r2 -A r2_sbo_r_hex_bin2str

Valgrind log:

==7639== Memcheck, a memory error detector
==7639== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==7639== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==7639== Command: r2 -A r2_sbo_r_hex_bin2str
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x7E23350: r_asm_disassemble (asm.c:409)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x7E23447: r_asm_disassemble (asm.c:423)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C324A3: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C3277C: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C32545: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C3268B: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326AC: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326D6: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x51FAB5B: r_core_anal_op (canal.c:773)
==7639==    by 0x5205483: fcn_callconv (canal.c:2312)
==7639==    by 0x51519AA: cmd_anal_fcn (cmd_anal.c:2464)
==7639==    by 0x50CE430: cmd_anal (cmd_anal.c:6103)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639==    by 0x50B855E: r_core_cmd_subst_i (cmd.c:2383)
==7639==    by 0x50B855E: r_core_cmd_subst (cmd.c:1562)
==7639==    by 0x50B1C64: r_core_cmd (cmd.c:3011)
==7639==    by 0x520C1B8: r_core_anal_all (canal.c:2843)
==7639==    by 0x50CFF6A: cmd_anal_all (cmd_anal.c:5801)
==7639==    by 0x50CFF6A: cmd_anal (cmd_anal.c:6124)
==7639==    by 0x51F5A81: r_cmd_call (cmd_api.c:227)
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326D6: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0xFFEFFE1F3: ???
==7639==    by 0xB4D4E7F: ???
==7639==    by 0xFFEFFE2C7: ???
==7639==    by 0x504A66B: ??? (in /usr/local/lib/libr_core.so.2.0.0)
==7639==    by 0x504103F: ??? (in /usr/local/lib/libr_core.so.2.0.0)
==7639==    by 0xFFEFFE1F7: ???
==7639==    by 0x82F22E70: ???
==7639==    by 0x20BC8B8: ???
==7639==    by 0x30: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326D6: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x504103F: ??? (in /usr/local/lib/libr_core.so.2.0.0)
==7639==    by 0xFFEFFE1F7: ???
==7639==    by 0x82F22E70: ???
==7639==    by 0x20BC8B8: ???
==7639==    by 0x30: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326E7: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C326FB: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Invalid read of size 2
==7639==    at 0x4C32720: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639==  Address 0xa6492c0 is 256 bytes inside a block of size 257 alloc'd
==7639==    at 0x4C2FB55: calloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x508B004: r_core_init (core.c:1663)
==7639==    by 0x10B8B1: main (radare2.c:459)
==7639== 
==7639== Use of uninitialised value of size 8
==7639==    at 0x4C32723: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C3272E: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x4C32739: memcpy@@GLIBC_2.14 (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7639==    by 0x7E2366D: r_asm_disassemble (asm.c:441)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x981D419: r_hex_bin2str (hex.c:164)
==7639==    by 0x7E236F3: r_asm_disassemble (asm.c:443)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Conditional jump or move depends on uninitialised value(s)
==7639==    at 0x981D452: r_hex_bin2str (hex.c:166)
==7639==    by 0x7E236F3: r_asm_disassemble (asm.c:443)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== Invalid read of size 1
==7639==    at 0x981D4CD: r_hex_bin2str (hex.c:167)
==7639==    by 0x7E236F3: r_asm_disassemble (asm.c:443)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639==  Address 0x3030f5c23066b079 is not stack'd, malloc'd or (recently) free'd
==7639== 
==7639== 
==7639== Process terminating with default action of signal 11 (SIGSEGV)
==7639==  General Protection Fault
==7639==    at 0x981D4CD: r_hex_bin2str (hex.c:167)
==7639==    by 0x7E236F3: r_asm_disassemble (asm.c:443)
==7639==    by 0x3066B0790030307E: ???
==7639==    by 0x303030303030F5C1: ???
==7639==    by 0x303030300E30302F: ???
==7639==    by 0x303030303000302F: ???
==7639==    by 0x300030303030302F: ???
==7639==    by 0x303030303030302F: ???
==7639==    by 0x3030303030302F: ???
==7639==    by 0x3030303030303078: ???
==7639==    by 0xFFFF66B03030302F: ???
==7639==    by 0xFFFFFFFFFFFFFFFE: ???
==7639== 
==7639== HEAP SUMMARY:
==7639==     in use at exit: 1,454,549 bytes in 17,597 blocks
==7639==   total heap usage: 26,049 allocs, 8,452 frees, 37,547,563 bytes allocated
==7639== 
==7639== LEAK SUMMARY:
==7639==    definitely lost: 832 bytes in 2 blocks
==7639==    indirectly lost: 48 bytes in 8 blocks
==7639==      possibly lost: 0 bytes in 0 blocks
==7639==    still reachable: 1,453,669 bytes in 17,587 blocks
==7639==         suppressed: 0 bytes in 0 blocks
==7639== Rerun with --leak-check=full to see details of leaked memory
==7639== 
==7639== For counts of detected and suppressed errors, rerun with: -v
==7639== Use --track-origins=yes to see where uninitialised values come from
==7639== ERROR SUMMARY: 27 errors from 19 contexts (suppressed: 0 from 0)
@radare
Copy link
Collaborator

radare commented Oct 11, 2017

fixed in 52b1526

@radare radare closed this as completed Oct 11, 2017
@traceprobe traceprobe mentioned this issue Apr 17, 2018
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@radare @fumfel