Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Heap buffer overflow on cmft::imageTransformArg #48

Open
strongcourage opened this issue May 27, 2019 · 0 comments
Open

Heap buffer overflow on cmft::imageTransformArg #48

strongcourage opened this issue May 27, 2019 · 0 comments

Comments

@strongcourage
Copy link

Hi,

Our fuzzer found a crash due to a heap buffer overflow on the function cmft::imageTransformArg. I built cmft (the latest commit 06a3516 on master) using the configuration "release64" on Ubuntu 16.04 (64-bit).

PoC_hbo_imageTransformArg: https://github.com/strongcourage/PoCs/blob/master/cmft_06a3516/PoC_hbo_imageTransformArg

cmftRelease --input PoC_hbo_imageTransformArg --output0 /dev/null
*** Error in `./cmftRelease': free(): invalid next size (fast): 0x00000000014d3e60 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7f0dcf26a7e5]
/lib/x86_64-linux-gnu/libc.so.6(+0x8037a)[0x7f0dcf27337a]
/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7f0dcf27753c]
./cmftRelease[0x41dbc1]
./cmftRelease[0x40c667]
./cmftRelease[0x41a4a2]
./cmftRelease[0x41a5e3]
./cmftRelease[0x43c6f8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f0dcf213830]
./cmftRelease[0x402269]
======= Memory map: ========
00400000-0044e000 r-xp 00000000 103:01 3678247                           /home/dungnguyen/PoCs/cmft_06a3516/cmftRelease
0064d000-0064e000 r--p 0004d000 103:01 3678247                           /home/dungnguyen/PoCs/cmft_06a3516/cmftRelease
0064e000-0064f000 rw-p 0004e000 103:01 3678247                           /home/dungnguyen/PoCs/cmft_06a3516/cmftRelease
0064f000-006a2000 rw-p 00000000 00:00 0 
014c1000-014f3000 rw-p 00000000 00:00 0                                  [heap]
7f0dc8000000-7f0dc8021000 rw-p 00000000 00:00 0 
7f0dc8021000-7f0dcc000000 ---p 00000000 00:00 0 
7f0dcf1f3000-7f0dcf3b3000 r-xp 00000000 103:03 4718690                   /lib/x86_64-linux-gnu/libc-2.23.so
7f0dcf3b3000-7f0dcf5b3000 ---p 001c0000 103:03 4718690                   /lib/x86_64-linux-gnu/libc-2.23.so
7f0dcf5b3000-7f0dcf5b7000 r--p 001c0000 103:03 4718690                   /lib/x86_64-linux-gnu/libc-2.23.so
7f0dcf5b7000-7f0dcf5b9000 rw-p 001c4000 103:03 4718690                   /lib/x86_64-linux-gnu/libc-2.23.so
7f0dcf5b9000-7f0dcf5bd000 rw-p 00000000 00:00 0 
7f0dcf5bd000-7f0dcf5d3000 r-xp 00000000 103:03 4723208                   /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0dcf5d3000-7f0dcf7d2000 ---p 00016000 103:03 4723208                   /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0dcf7d2000-7f0dcf7d3000 rw-p 00015000 103:03 4723208                   /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0dcf7d3000-7f0dcf8db000 r-xp 00000000 103:03 4723188                   /lib/x86_64-linux-gnu/libm-2.23.so
7f0dcf8db000-7f0dcfada000 ---p 00108000 103:03 4723188                   /lib/x86_64-linux-gnu/libm-2.23.so
7f0dcfada000-7f0dcfadb000 r--p 00107000 103:03 4723188                   /lib/x86_64-linux-gnu/libm-2.23.so
7f0dcfadb000-7f0dcfadc000 rw-p 00108000 103:03 4723188                   /lib/x86_64-linux-gnu/libm-2.23.so
7f0dcfadc000-7f0dcfc4e000 r-xp 00000000 103:03 5376129                   /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f0dcfc4e000-7f0dcfe4e000 ---p 00172000 103:03 5376129                   /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f0dcfe4e000-7f0dcfe58000 r--p 00172000 103:03 5376129                   /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f0dcfe58000-7f0dcfe5a000 rw-p 0017c000 103:03 5376129                   /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.21
7f0dcfe5a000-7f0dcfe5e000 rw-p 00000000 00:00 0 
7f0dcfe5e000-7f0dcfe76000 r-xp 00000000 103:03 4718677                   /lib/x86_64-linux-gnu/libpthread-2.23.so
7f0dcfe76000-7f0dd0075000 ---p 00018000 103:03 4718677                   /lib/x86_64-linux-gnu/libpthread-2.23.so
7f0dd0075000-7f0dd0076000 r--p 00017000 103:03 4718677                   /lib/x86_64-linux-gnu/libpthread-2.23.so
7f0dd0076000-7f0dd0077000 rw-p 00018000 103:03 4718677                   /lib/x86_64-linux-gnu/libpthread-2.23.so
7f0dd0077000-7f0dd007b000 rw-p 00000000 00:00 0 
7f0dd007b000-7f0dd007e000 r-xp 00000000 103:03 4718675                   /lib/x86_64-linux-gnu/libdl-2.23.so
7f0dd007e000-7f0dd027d000 ---p 00003000 103:03 4718675                   /lib/x86_64-linux-gnu/libdl-2.23.so
7f0dd027d000-7f0dd027e000 r--p 00002000 103:03 4718675                   /lib/x86_64-linux-gnu/libdl-2.23.so
7f0dd027e000-7f0dd027f000 rw-p 00003000 103:03 4718675                   /lib/x86_64-linux-gnu/libdl-2.23.so
7f0dd027f000-7f0dd0286000 r-xp 00000000 103:03 4718609                   /lib/x86_64-linux-gnu/librt-2.23.so
7f0dd0286000-7f0dd0485000 ---p 00007000 103:03 4718609                   /lib/x86_64-linux-gnu/librt-2.23.so
7f0dd0485000-7f0dd0486000 r--p 00006000 103:03 4718609                   /lib/x86_64-linux-gnu/librt-2.23.so
7f0dd0486000-7f0dd0487000 rw-p 00007000 103:03 4718609                   /lib/x86_64-linux-gnu/librt-2.23.so
7f0dd0487000-7f0dd04ad000 r-xp 00000000 103:03 4718676                   /lib/x86_64-linux-gnu/ld-2.23.so
7f0dd05fb000-7f0dd0683000 rw-p 00000000 00:00 0 
7f0dd06ab000-7f0dd06ac000 rw-p 00000000 00:00 0 
7f0dd06ac000-7f0dd06ad000 r--p 00025000 103:03 4718676                   /lib/x86_64-linux-gnu/ld-2.23.so
7f0dd06ad000-7f0dd06ae000 rw-p 00026000 103:03 4718676                   /lib/x86_64-linux-gnu/ld-2.23.so
7f0dd06ae000-7f0dd06af000 rw-p 00000000 00:00 0 
7ffdfd266000-7ffdfd29b000 rw-p 00000000 00:00 0                          [stack]
7ffdfd2eb000-7ffdfd2ee000 r--p 00000000 00:00 0                          [vvar]
7ffdfd2ee000-7ffdfd2f0000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted

ASAN says:

cmftRelease-asan --input PoC_hbo_imageTransformArg --output0 /dev/null
=================================================================
==10155==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eff1 at pc 0x7f49a188e935 bp 0x7ffca76070c0 sp 0x7ffca7606868
READ of size 3 at 0x60200000eff1 thread T0
    #0 0x7f49a188e934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)
    #1 0x428adf in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:53
    #2 0x428adf in swap ../../src/cmft/common/utils.h:131
    #3 0x428adf in cmft::imageTransformArg(cmft::Image&, __va_list_tag*) ../../src/cmft/image.cpp:2506
    #4 0x429a91 in cmft::imageTransformUseMacroInstead(cmft::Image*, ...) ../../src/cmft/image.cpp:2321
    #5 0x4340d2 in cmft::imageLoadTga(cmft::Image&, cmft::Rw*, cmft::AllocatorI*) ../../src/cmft/image.cpp:4972
    #6 0x4344b3 in cmft::imageLoad(cmft::Image&, cmft::Rw*, cmft::TextureFormat::Enum, cmft::AllocatorI*) ../../src/cmft/image.cpp:5039
    #7 0x4348a9 in cmft::imageLoad(cmft::Image&, char const*, cmft::TextureFormat::Enum, cmft::AllocatorI*) ../../src/cmft/image.cpp:5062
    #8 0x475600 in cmftMain(int, char const* const*) ../../src/cmft_cli/cmft_cli.h:895
    #9 0x7f49a058e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #10 0x403608 in _start (/home/dungnguyen/PoCs/cmft_06a3516/cmftRelease-asan+0x403608)

0x60200000eff1 is located 0 bytes to the right of 1-byte region [0x60200000eff0,0x60200000eff1)
allocated by thread T0 here:
    #0 0x7f49a189a602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x433f18 in cmft::imageLoadTga(cmft::Image&, cmft::Rw*, cmft::AllocatorI*) ../../src/cmft/image.cpp:4899

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy
Shadow bytes around the buggy address:
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9df0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[01]fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==10155==ABORTING

Thanks,
Manh Dung
@strongcourage strongcourage changed the title Segmentation fault (ASAN: heap-buffer-overflow) on cmft::imageTransformArg Heap buffer overflow on cmft::imageTransformArg May 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@strongcourage