Open
Description
System info:
Ubuntu 16.04.6 LTS, X64, gcc 5.4.0, yasm (latest master 009450c)
I think it is probably a similar issue as #126
Compile Command:
$ ./autogen.sh
make distclean
CC=gcc CXX=g++ CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" ./configure --prefix=$PWD/build --disable-shared
make -j
make install
Run Command:
$ yasm $POC
POC file:
https://github.com/Clingto/POC/blob/master/MSA/yasm/yasm-1226-expr_traverse_nodes_post-UAF
ASAN info:
yasm: file name already has no extension: output will be in `yasm.out'
=================================================================
==11980==ERROR: AddressSanitizer: heap-use-after-free on address 0x60600000e5b0 at pc 0x7f418ef4a94b bp 0x7ffedeadea70 sp 0x7ffedeadea60
READ of size 4 at 0x60600000e5b0 thread T0
#0 0x7f418ef4a94a in expr_traverse_nodes_post test/yasm-uaf/SRC_asan/libyasm/expr.c:1112
#1 0x7f418ef4a94a in yasm_expr_destroy test/yasm-uaf/SRC_asan/libyasm/expr.c:1045
#2 0x7f418b7ebda1 in bin_section_data_destroy test/yasm-uaf/SRC_asan/modules/objfmts/bin/bin-objfmt.c:1684
#3 0x7f418ef2e548 in yasm__assoc_data_destroy test/yasm-uaf/SRC_asan/libyasm/assocdat.c:128
#4 0x7f418ef6dd24 in yasm_section_destroy test/yasm-uaf/SRC_asan/libyasm/section.c:676
#5 0x7f418ef6dd24 in yasm_object_destroy test/yasm-uaf/SRC_asan/libyasm/section.c:470
#6 0x404ad4 in cleanup test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:799
#7 0x4053e3 in check_errors test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:778
#8 0x402c9a in do_assemble test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:524
#9 0x402c9a in main test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:753
#10 0x7f418e96f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#11 0x403ee8 in _start ( test/yasm-uaf/bin_asan/bin/yasm+0x403ee8)
0x60600000e5b0 is located 16 bytes inside of 56-byte region [0x60600000e5a0,0x60600000e5d8)
freed by thread T0 here:
#0 0x7f418f2292ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)
#1 0x7f418ef76caa in yasm_dir_helper_expr test/yasm-uaf/SRC_asan/libyasm/valparam.c:312
#2 0x7f418ef769ff in yasm_dir_helper test/yasm-uaf/SRC_asan/libyasm/valparam.c:241
#3 0x7f418b7eb34b in bin_objfmt_section_switch test/yasm-uaf/SRC_asan/modules/objfmts/bin/bin-objfmt.c:1521
#4 0x7f418ef6cd75 in dir_section test/yasm-uaf/SRC_asan/libyasm/section.c:154
#5 0x7f418ef6d838 in yasm_object_directive test/yasm-uaf/SRC_asan/libyasm/section.c:377
#6 0x7f418b78f804 in nasm_parser_directive test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:1569
#7 0x7f418b79bd3c in parse_line test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:377
#8 0x7f418b79bd3c in nasm_parser_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:231
#9 0x7f418b78f36b in nasm_do_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:66
#10 0x7f418b78f36b in nasm_parser_do_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:83
#11 0x402c84 in do_assemble test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:521
#12 0x402c84 in main test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:753
#13 0x7f418e96f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
previously allocated by thread T0 here:
#0 0x7f418f229602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
#1 0x7f418ef7a769 in def_xmalloc test/yasm-uaf/SRC_asan/libyasm/xmalloc.c:69
#2 0x7f418ef46fd2 in yasm_expr__copy_except test/yasm-uaf/SRC_asan/libyasm/expr.c:998
#3 0x7f418ef76cd0 in yasm_dir_helper_expr test/yasm-uaf/SRC_asan/libyasm/valparam.c:313
#4 0x7f418ef769ff in yasm_dir_helper test/yasm-uaf/SRC_asan/libyasm/valparam.c:241
#5 0x7f418b7eb34b in bin_objfmt_section_switch test/yasm-uaf/SRC_asan/modules/objfmts/bin/bin-objfmt.c:1521
#6 0x7f418ef6cd75 in dir_section test/yasm-uaf/SRC_asan/libyasm/section.c:154
#7 0x7f418ef6d838 in yasm_object_directive test/yasm-uaf/SRC_asan/libyasm/section.c:377
#8 0x7f418b78f804 in nasm_parser_directive test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:1569
#9 0x7f418b79bd3c in parse_line test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:377
#10 0x7f418b79bd3c in nasm_parser_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:231
#11 0x7f418b78f36b in nasm_do_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:66
#12 0x7f418b78f36b in nasm_parser_do_parse test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:83
#13 0x402c84 in do_assemble test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:521
#14 0x402c84 in main test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:753
#15 0x7f418e96f82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
SUMMARY: AddressSanitizer: heap-use-after-free test/yasm-uaf/SRC_asan/libyasm/expr.c:1112 expr_traverse_nodes_post
Shadow bytes around the buggy address:
0x0c0c7fff9c60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9c70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9ca0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fa
=>0x0c0c7fff9cb0: fa fa fa fa fd fd[fd]fd fd fd fd fa fa fa fa fa
0x0c0c7fff9cc0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fff9cd0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c7fff9ce0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c7fff9cf0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fff9d00: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==11980==ABORTINGMetadata
Assignees
Labels
No labels