heap-buffer-overflow read in check_row()

[kcwu]

input (xxd cases/tats-w3m-67)

00000000: 3030 3030 3c6e 6f62 723e 3030 3030 3030  0000<nobr>000000
00000010: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000020: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000
00000040: 3030 3030 303c 7461 626c 653e 3c74 6578  00000<table><tex
00000050: 7461 7265 613e 3c74 6162 6c65 2030 3030  tarea><table 000
00000060: 3030 3030 3030 3e3c 7461 626c 653e       000000><table>

how to reproduce:

ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 LD_LIBRARY_PATH=./notgc ./w3m-tats.asan -T text/html -dump cases/tats-w3m-67

stderr:

=================================================================
==3694914==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000ea38 at pc 0x0000005f6580 bp 0x7ffd9c61a310 sp 0x7ffd9c61a308
READ of size 8 at 0x61400000ea38 thread T0
    #0 0x5f657f in check_row /targets/w3m-tats/table.c:377:9
    #1 0x62126f in pushTable /targets/w3m-tats/table.c:3337:5
    #2 0x591ef8 in HTMLlineproc0 /targets/w3m-tats/file.c:6434:7
    #3 0x5a7d14 in completeHTMLstream /targets/w3m-tats/file.c:7022:2
    #4 0x5a5b21 in loadHTMLstream /targets/w3m-tats/file.c:7258:5
    #5 0x55bbf8 in loadHTMLBuffer /targets/w3m-tats/file.c:6781:5
    #6 0x55ee64 in loadSomething /targets/w3m-tats/file.c:224:16
    #7 0x5535ac in loadGeneralFile /targets/w3m-tats/file.c:2241:6
    #8 0x4f9202 in main /targets/w3m-tats/main.c:1017:12
    #9 0x7f2abcb78f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287
    #10 0x41bf25 in _start (/w3m-tats.asan+0x41bf25)

0x61400000ea38 is located 8 bytes to the left of 400-byte region [0x61400000ea40,0x61400000ebd0)
allocated by thread T0 here:
    #0 0x4c63fc in calloc (/w3m-tats.asan+0x4c63fc)
    #1 0x7f2abe2c6b05 in GC_malloc /notgc/notgc.c:259
    #2 0x60f8f5 in begin_table /targets/w3m-tats/table.c:1998:9
    #3 0x588e40 in HTMLtagproc1 /targets/w3m-tats/file.c:5039:30
    #4 0x5927e3 in HTMLlineproc0 /targets/w3m-tats/file.c:6477:10
    #5 0x595554 in HTMLlineproc0 /targets/w3m-tats/file.c:6621:7
    #6 0x5a5a0c in loadHTMLstream /targets/w3m-tats/file.c:7252:2
    #7 0x55bbf8 in loadHTMLBuffer /targets/w3m-tats/file.c:6781:5
    #8 0x55ee64 in loadSomething /targets/w3m-tats/file.c:224:16
    #9 0x5535ac in loadGeneralFile /targets/w3m-tats/file.c:2241:6
    #10 0x4f9202 in main /targets/w3m-tats/main.c:1017:12
    #11 0x7f2abcb78f44 in __libc_start_main /build/eglibc-oGUzwX/eglibc-2.19/csu/libc-start.c:287

SUMMARY: AddressSanitizer: heap-buffer-overflow /targets/w3m-tats/table.c:377:9 in check_row
Shadow bytes around the buggy address:
  0x0c287fff9cf0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
  0x0c287fff9d00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c287fff9d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9d30: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
=>0x0c287fff9d40: fa fa fa fa fa fa fa[fa]00 00 00 00 00 00 00 00
  0x0c287fff9d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9d70: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
  0x0c287fff9d80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c287fff9d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3694914==ABORTING

This is detected with help of dummy libgc wrapper. See http://github.com/kcwu/fuzzing-w3m/notgc for detail.
More detail to reproduce please see http://github.com/kcwu/fuzzing-w3m

For your convenience,
gdbline:
LD_LIBRARY_PATH=./notgc ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 gdb --args ./w3m-tats.asan -T text/html -dump cases/tats-w3m-67

This is found by afl-fuzz.

[kcwu]

This one is serious because the next line will be overflow write (row=-1)

377         if (t->tabdata[row] == NULL) {
378             t->tabdata[row] = New_N(GeneralList *, MAXCOL);

[tats]

Fixed, thank you.

[kcwu]

FYI, if this issue is not fixed, it will segfault later due to dereference invalid pointer tbl->tabattr[row] (where row=-1)