From: Rich Felker <dalias@libc.org>
To: Konstantin Serebryany <konstantin.s.serebryany@gmail.com>
Cc: musl@lists.openwall.com, Szabolcs Nagy <szabolcs.nagy@arm.com>
Subject: Re: buffer overflow in regcomp and a way to find more of those
Date: Fri, 20 Mar 2015 16:40:00 -0400 [thread overview]
Message-ID: <20150320204000.GO23507@brightrain.aerifal.cx> (raw)
In-Reply-To: <CAGQ9bdxBDFu+7cnBFxk_toa_C0qwVCgLG=Jc7zMs8cVB8y+UFA@mail.gmail.com>
On Fri, Mar 20, 2015 at 01:17:47PM -0700, Konstantin Serebryany wrote:
> Hi,
>
> Following the discussion at the glibc mailing list
> (https://sourceware.org/ml/libc-alpha/2015-03/msg00662.html)
> I've tried to fuzz musl regcomp and the first bug popped up quickly.
> Please let me know if you would be interested in adding the fuzzer
> (http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/README.txt?view=markup)
> to the musl testing process.
>
> Exact repro steps, just copy-paste (assuming you have fresh clang)
> =================== ===============
> tar xf ~/Downloads/musl-1.1.7.tar.gz
> cd musl-1.1.7
> ../configure && make -j
> cat << EOF > bug1.c
> #include <string.h>
> #include <stdlib.h>
> #include "regex.h"
>
> int main() {
> regex_t preg;
> char a[] = {40, 123, 33, 124, 33, 19, 40, 96, 92, 253, 92, 123, 51,
> 48, 92, 125, 0};
Simplified test case:
char a[] = "\\\375\\{2\\}";
The problem seems to be handling of [backslash], [illegal sequence],
[repetition]. I haven't analyzed the cause, but that was my initial
guess and the minimal example I was able to reduce it to without the
crash disappearing.
Rich
next prev parent reply other threads:[~2015-03-20 20:40 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-20 20:17 Konstantin Serebryany
2015-03-20 20:40 ` Rich Felker [this message]
2015-03-20 21:28 ` Szabolcs Nagy
2015-03-20 23:48 ` Szabolcs Nagy
2015-03-20 22:32 ` Rich Felker
2015-03-20 23:52 ` Szabolcs Nagy
2015-03-21 0:06 ` Konstantin Serebryany
2015-03-21 0:26 ` Szabolcs Nagy
2015-03-21 0:46 ` Rich Felker
2015-03-21 0:54 ` Konstantin Serebryany
2015-03-21 1:00 ` Rich Felker
2015-03-21 1:05 ` Konstantin Serebryany
2015-03-21 1:10 ` Konstantin Serebryany
2015-03-21 1:23 ` Szabolcs Nagy
2015-03-21 1:30 ` Rich Felker
2015-03-21 2:10 ` Szabolcs Nagy
2015-03-21 2:17 ` Rich Felker
2015-03-21 1:32 ` Rich Felker
2015-03-21 1:37 ` Konstantin Serebryany
2015-03-21 1:56 ` Rich Felker
2015-03-21 2:14 ` Konstantin Serebryany
2015-03-21 2:20 ` Rich Felker
2015-03-21 6:05 ` Konstantin Serebryany
2015-03-21 13:28 ` Szabolcs Nagy
2015-03-21 21:03 ` Szabolcs Nagy
2015-03-21 21:38 ` Szabolcs Nagy
2015-03-21 22:13 ` Szabolcs Nagy
2015-03-22 6:36 ` Justin Cormack
2015-03-23 5:02 ` Konstantin Serebryany
2015-03-23 12:25 ` Szabolcs Nagy
2015-03-23 15:56 ` Konstantin Serebryany
2015-03-23 4:55 ` Konstantin Serebryany
2015-03-23 12:35 ` Szabolcs Nagy
2015-03-23 14:40 ` stephen Turner
2015-03-23 14:53 ` Szabolcs Nagy
2015-03-23 15:46 ` stephen Turner
2015-03-23 16:28 ` Rich Felker
2015-03-23 17:21 ` Nathan McSween
2015-03-28 22:00 ` Szabolcs Nagy
2015-03-28 22:32 ` Konstantin Serebryany
2015-03-28 22:38 ` Rich Felker
2015-03-28 23:15 ` Szabolcs Nagy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150320204000.GO23507@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=konstantin.s.serebryany@gmail.com \
--cc=musl@lists.openwall.com \
--cc=szabolcs.nagy@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).