Skip to content

AddressSanitizer: heap-buffer-overflow src/ast/lex_conf.cc:4012 in re2c::Scanner::lex_conf_string[abi:cxx11]() #228

@fgeek

Description

@fgeek

Tested commit: c432c5c
Tools: american fuzzy lop 2.52b, afl-utils
re2c-2018-11-04-002.zip

=================================================================
==22299==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000e900 at pc 0x55c796156885 bp 0x7ffd5faa4b10 sp 0x7ffd5faa4b08
READ of size 1 at 0x62500000e900 thread T0
    #0 0x55c796156884 in re2c::Scanner::lex_conf_string[abi:cxx11]() src/ast/lex_conf.cc:4012
    #1 0x55c796166137 in re2c::Scanner::lex_conf(re2c::Opt&) ../src/ast/lex_conf.re:156
    #2 0x55c796141b60 in yyparse(re2c::context_t&) src/ast/parser.ypp:69
    #3 0x55c796145ead in re2c::parse(re2c::Scanner&, std::vector<re2c::spec_t, std::allocator<re2c::spec_t> >&, std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, re2c::AST const*, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, re2c::AST const*> > >&, re2c::Opt&) src/ast/parser.ypp:271
    #4 0x55c79606b2c1 in re2c::compile(re2c::Scanner&, re2c::Output&, re2c::Opt&) src/compile.cc:155
    #5 0x55c795e645f9 in main src/main.cc:31
    #6 0x7fa48d95c2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #7 0x55c795e65709 in _start (/home/hsalo/builds/re2c/c432c5c34c60a9e450714a7d1d5c39b34c9fd0a0/bin/re2c+0x1e709)

0x62500000e900 is located 0 bytes to the right of 8192-byte region [0x62500000c900,0x62500000e900)
allocated by thread T0 here:
    #0 0x7fa48e63ad70 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc2d70)
    #1 0x55c796104d49 in re2c::Scanner::fill(unsigned int) src/ast/scanner.cc:63
    #2 0x55c79612262b in re2c::Scanner::echo(re2c::OutputFile&) src/ast/lex.cc:94
    #3 0x55c79606b1c2 in re2c::compile(re2c::Scanner&, re2c::Output&, re2c::Opt&) src/compile.cc:140
    #4 0x55c795e645f9 in main src/main.cc:31
    #5 0x7fa48d95c2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-buffer-overflow src/ast/lex_conf.cc:4012 in re2c::Scanner::lex_conf_string[abi:cxx11]()
Shadow bytes around the buggy address:
  0x0c4a7fff9cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fff9d20:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22299==ABORTING

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions