From mboxrd@z Thu Jan  1 00:00:00 1970
X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/7245
Path: news.gmane.org!not-for-mail
From: Szabolcs Nagy <nsz@port70.net>
Newsgroups: gmane.linux.lib.musl.general
Subject: Re: buffer overflow in regcomp and a way to find more of those
Date: Sat, 21 Mar 2015 22:38:25 +0100
Message-ID: <20150321213825.GK16260@port70.net>
References: <20150321010043.GR23507@brightrain.aerifal.cx>
 <CAGQ9bdzxrkdGJb1z4e9m9QC97WKbRgG=jasvy4v1-sf0kX08AQ@mail.gmail.com>
 <20150321013225.GT23507@brightrain.aerifal.cx>
 <CAGQ9bdxWaaUBv3gmDE3meSaibjJiUmcAfSae_OTrkky1tjVYLQ@mail.gmail.com>
 <20150321015619.GU23507@brightrain.aerifal.cx>
 <CAGQ9bdwziW09Jn17M=5+qyi5Q-1+LTy4dr0d0Tkm2WP0ao-NzA@mail.gmail.com>
 <20150321022023.GW23507@brightrain.aerifal.cx>
 <CAGQ9bdwwhkcBse2K612ynZ34SLLCoGvNZTgeMPVK8V-WX56peA@mail.gmail.com>
 <20150321132810.GI16260@port70.net>
 <20150321210302.GJ16260@port70.net>
Reply-To: musl@lists.openwall.com
NNTP-Posting-Host: plane.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Trace: ger.gmane.org 1426973922 30221 80.91.229.3 (21 Mar 2015 21:38:42 GMT)
X-Complaints-To: usenet@ger.gmane.org
NNTP-Posting-Date: Sat, 21 Mar 2015 21:38:42 +0000 (UTC)
To: Konstantin Serebryany <konstantin.s.serebryany@gmail.com>,
	Rich Felker <dalias@libc.org>, musl@lists.openwall.com
Original-X-From: musl-return-7258-gllmg-musl=m.gmane.org@lists.openwall.com Sat Mar 21 22:38:41 2015
Return-path: <musl-return-7258-gllmg-musl=m.gmane.org@lists.openwall.com>
Envelope-to: gllmg-musl@m.gmane.org
Original-Received: from mother.openwall.net ([195.42.179.200])
	by plane.gmane.org with smtp (Exim 4.69)
	(envelope-from <musl-return-7258-gllmg-musl=m.gmane.org@lists.openwall.com>)
	id 1YZR6N-0003PY-MS
	for gllmg-musl@m.gmane.org; Sat, 21 Mar 2015 22:38:39 +0100
Original-Received: (qmail 18182 invoked by uid 550); 21 Mar 2015 21:38:37 -0000
Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm
Precedence: bulk
List-Post: <mailto:musl@lists.openwall.com>
List-Help: <mailto:musl-help@lists.openwall.com>
List-Unsubscribe: <mailto:musl-unsubscribe@lists.openwall.com>
List-Subscribe: <mailto:musl-subscribe@lists.openwall.com>
Original-Received: (qmail 18163 invoked from network); 21 Mar 2015 21:38:37 -0000
Mail-Followup-To: Konstantin Serebryany <konstantin.s.serebryany@gmail.com>,
	Rich Felker <dalias@libc.org>, musl@lists.openwall.com
Content-Disposition: inline
In-Reply-To: <20150321210302.GJ16260@port70.net>
User-Agent: Mutt/1.5.23 (2014-03-12)
Xref: news.gmane.org gmane.linux.lib.musl.general:7245
Archived-At: <http://permalink.gmane.org/gmane.linux.lib.musl.general/7245>

* Szabolcs Nagy <nsz@port70.net> [2015-03-21 22:03:02 +0100]:
...
> r12            0x10	16
> r13            0x7	7
> r14            0x6e2dc3	7220675
> r15            0x1	1
> rip            0x47a05b	0x47a05b <inet_pton+1307>
> eflags         0x10202	[ IF RF ]
> cs             0x33	51
> ss             0x2b	43
> ds             0x0	0
> es             0x0	0
> fs             0x63	99
> gs             0x0	0
> (gdb) p (char*)0x6e2dc3
> $3 = 0x6e2dc3 "2.8288;3:33::2.82.83333"
> (gdb) 


ah.. r14 is incremented as the string is parsed
the original string is

(gdb) p (char*)0x6e2dc3-35
$37 = 0x6e2da0 "8:a:2:8:3:28:8::2:83:20:8:2:833:23:2.8288;3:33::2.82.83333"

with this i can reproduce the crash