Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiple heap out-of-bounds writes of size 1 in marshal.c #2963

Closed
m4drat opened this issue Aug 22, 2022 · 1 comment · Fixed by #2977
Closed

Multiple heap out-of-bounds writes of size 1 in marshal.c #2963

m4drat opened this issue Aug 22, 2022 · 1 comment · Fixed by #2977
Labels
Milestone

Comments

@m4drat
Copy link

m4drat commented Aug 22, 2022

Hi! We've been fuzzing your project and found the following errors in librz/bin/format/pyc/marshal.c

Work environment

OS: Ubuntu 20.04
File format: -
rizin version: 4b38597

Bug description

Heap out-of-bounds write (segv) of size 1 in librz/bin/format/pyc/marshal.c:345 and librz/bin/format/pyc/marshal.c:366

Steps to reproduce

  1. Build docker container from https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/rizin: sudo docker build -t oss-sydr-fuzz-rizin .

  2. Run docker container: sudo docker run --privileged --network host -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-rizin /bin/bash

  3. Execute rizin with crashing input (1) (we sent all crashing inputs to you by email):
    /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-29b84af05a36d9628093200a1a07b7d931009c84

  4. Execute rizin with crashing input (2):
    /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-490d344f047c5223f5bfe701dfb406ca2a00710d

  5. You will see the following output (for the first crashing input, the second one is similar):

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2489412==ERROR: AddressSanitizer: SEGV on unknown address 0x6021001ae90f (pc 0x000000d0fdf8 bp 0x7ffde0cc5c90 sp 0x7ffde0cc5ac0 T0)
==2489412==The signal is caused by a WRITE memory access.
    #0 0xd0fdf8 in get_complex_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:345:9
    #1 0xd0fdf8 in get_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:1083:9
    #2 0xd1159a in get_array_object_generic /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:494:9
    #3 0xd0dd06 in get_set_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:624:8
    #4 0xd0dd06 in get_object /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:1102:9
    #5 0xd0d316 in get_sections_symbols_from_code_objects /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:1197:38
    #6 0xb6a06e in symbols /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/p/bin_pyc.c:129:2
    #7 0xae7bf4 in rz_bin_object_set_items /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bobj.c:455:16
    #8 0xae706b in rz_bin_object_new /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bobj.c:319:2
    #9 0xad7d31 in rz_bin_file_new_from_buffer /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bfile.c:150:19
    #10 0xadf3c7 in rz_bin_open_buf /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:272:8
    #11 0xadec27 in rz_bin_open_io /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:330:18
    #12 0x1003353 in core_file_do_load_for_io_plugin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:727:23
    #13 0x1003353 in rz_core_bin_load /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/cfile.c:974:4
    #14 0x5b9af8 in rz_main_rizin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/main/rizin.c:1119:14
    #15 0x7f4055fa8082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #16 0x41da3d in _start (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x41da3d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/pyc/marshal.c:345:9 in get_complex_object
==2489412==ABORTING
@m4drat
Copy link
Author

m4drat commented Aug 22, 2022

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants