Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Out of bounds read access in function get_symbols_from_phdr() #2706

Closed
hannob opened this issue Jun 3, 2015 · 0 comments
Closed

Out of bounds read access in function get_symbols_from_phdr() #2706

hannob opened this issue Jun 3, 2015 · 0 comments
Milestone

Comments

@hannob
Copy link

hannob commented Jun 3, 2015

This malformed elf will cause an out of bounds heap read access in the function get_symbols_from_phdr:
https://crashes.fuzzing-project.org/radare2-oob-heap-read-get_symbols_from_phdr

Found with american fuzzy lop.

Stack trace from address sanitizer:

==28367==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300001d2a5 at pc 0x7f3fb110c9ed bp 0x7fff0f59d590 sp 0x7fff0f59d580
READ of size 1 at 0x60300001d2a5 thread T0
    #0 0x7f3fb110c9ec in __strnlen /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:12
    #1 0x7f3fb110c9ec in get_symbols_from_phdr /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:1375
    #2 0x7f3fb10faab0 in imports /f/radare2/radare2/libr/..//libr/bin/p/bin_elf.c:354
    #3 0x7f3fb1031df0 in r_bin_object_set_items /f/radare2/radare2/libr/bin/bin.c:420
    #4 0x7f3fb1031df0 in r_bin_object_new /f/radare2/radare2/libr/bin/bin.c:945
    #5 0x7f3fb10381fa in r_bin_file_new_from_bytes /f/radare2/radare2/libr/bin/bin.c:1056
    #6 0x7f3fb10381fa in r_bin_load_io_at_offset_as_sz /f/radare2/radare2/libr/bin/bin.c:644
    #7 0x7f3fb1039aba in r_bin_load_io_at_offset_as /f/radare2/radare2/libr/bin/bin.c:666
    #8 0x7f3fb103aeb5 in r_bin_load_io /f/radare2/radare2/libr/bin/bin.c:546
    #9 0x7f3fb20909a0 in r_core_file_do_load_for_io_plugin /f/radare2/radare2/libr/core/file.c:350
    #10 0x7f3fb20909a0 in r_core_bin_load /f/radare2/radare2/libr/core/file.c:487
    #11 0x4059cd in main /f/radare2/radare2/binr/radare2/radare2.c:585
    #12 0x7f3fac577f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
    #13 0x40a0e3 (/mnt/ram/radare2/radare2+0x40a0e3)

0x60300001d2a5 is located 0 bytes to the right of 21-byte region [0x60300001d290,0x60300001d2a5)
allocated by thread T0 here:
    #0 0x7f3fb2713855 in calloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x57855)
    #1 0x7f3fb1110be3 in Elf64_r_bin_elf_init_dynamic_section /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:294
    #2 0x7f3fb1110be3 in Elf64_r_bin_elf_init /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:338

SUMMARY: AddressSanitizer: heap-buffer-overflow /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:12 __strnlen
Shadow bytes around the buggy address:
  0x0c067fffba00: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fffba10: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fffba20: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fffba30: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fffba40: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
=>0x0c067fffba50: fa fa 00 00[05]fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fffba60: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fffba70: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c067fffba80: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c067fffba90: 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa
  0x0c067fffbaa0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==28367==ABORTING
@alvarofe alvarofe self-assigned this Jun 4, 2015
@radare radare added this to the 0.9.9 milestone Jun 4, 2015
alvarofe added a commit to alvarofe/radare2 that referenced this issue Jun 4, 2015
# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

No branches or pull requests

3 participants