From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/7249 Path: news.gmane.org!not-for-mail From: Konstantin Serebryany Newsgroups: gmane.linux.lib.musl.general Subject: Re: buffer overflow in regcomp and a way to find more of those Date: Sun, 22 Mar 2015 22:02:48 -0700 Message-ID: References: <20150321010043.GR23507@brightrain.aerifal.cx> <20150321013225.GT23507@brightrain.aerifal.cx> <20150321015619.GU23507@brightrain.aerifal.cx> <20150321022023.GW23507@brightrain.aerifal.cx> <20150321132810.GI16260@port70.net> <20150321210302.GJ16260@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Trace: ger.gmane.org 1427087011 26508 80.91.229.3 (23 Mar 2015 05:03:31 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Mon, 23 Mar 2015 05:03:31 +0000 (UTC) To: Konstantin Serebryany , Rich Felker , musl@lists.openwall.com Original-X-From: musl-return-7262-gllmg-musl=m.gmane.org@lists.openwall.com Mon Mar 23 06:03:31 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1YZuWO-0001m3-Hb for gllmg-musl@m.gmane.org; Mon, 23 Mar 2015 06:03:28 +0100 Original-Received: (qmail 3614 invoked by uid 550); 23 Mar 2015 05:03:26 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 3566 invoked from network); 23 Mar 2015 05:03:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=KXGvousTgk0WN0H8k5jQkFwnwwSsZLeyEky/qzP07qE=; b=FWE1CEumJ44Vb0EpAvnSFScoFCLrj7leLkX2lzSql1yxJe2jHBHzf+GKELBJhi2z7g 7qRFzMdcMzdnBudANwzEsGfO58ayatOB1V3IWVKf5VW1+l5fXo2EFACMw6/Yf7eNefF9 hYHLBR2KWMo9mU7INXPgTaPXlDdRDDIbYcK9KUO82cM1iZpmOkXIQ4MwtJuDzzq4CpWl e2QdACNdR/ddzCnd/H6wGQWuB2r/lGeD+Qn6CtmvziA0+bRTGFxH2OwOWWuWHAtMPuF5 7Nqa3SPMhLLW5NWgm0jmOGqGse6OTUtYq23Hs2SJJimBkAQJOe6+dVCzMp+8nQQUWsNU X30g== X-Received: by 10.52.29.235 with SMTP id n11mr97560162vdh.75.1427086989275; Sun, 22 Mar 2015 22:03:09 -0700 (PDT) In-Reply-To: <20150321210302.GJ16260@port70.net> Xref: news.gmane.org gmane.linux.lib.musl.general:7249 Archived-At: On Sat, Mar 21, 2015 at 2:03 PM, Szabolcs Nagy wrote: > i wrote some trivial test cases for > > __dn_expand > __dns_parse > __pleval > fnmatch > inet_pton > strptime Cool! Is there something you plan to have in the repository or share some other way? > > to try out the concept, i've seen one crash so far: > a bus error when fuzzing inet_pton > > probably a stack corruption that overwrites the location > where %rbp is stored and then the memory access relative > to rbp crashes > > the fuzzing goes like: > > ./a.out -seed=1753234605 > ... > #8388608 cov: 546 bits: 0 exec/s: 838860 > #16777216 cov: 546 bits: 0 exec/s: 798915 This looks good. "exec/s: 798915" means that even with relatively weak search algorithm you can find lots of paths. > #27461772 NEW: 548 B: 0 L: 16 S: 22 I: 0 8283::2:2.8.83.3 16: 56 50 56 51 58 58 50 58 50 46 56 46 56 51 46 51 > #27469404 NEW: 549 B: 0 L: 24 S: 23 I: 2 8283::2:283:2.8.83.2.833 24: 56 50 56 51 58 58 50 58 50 56 51 58 50 46 56 46 56 51 46 50 46 56 51 51 > Bus error (core dumped) > > is there a way to get a reproducer after such a crash? > the fuzzer relies on asan to call at-crash handler -- this is what __sanitizer_set_death_callback is for. w/o asan you can set up a signal handler that will print fuzzer::Fuzzer::CurrentUnit. If everything else fails you can of course re-rerun the fuzzer with the same seed. > in this case i fortunately had the core dump > and i can see the inet_pton argument in %r14 > but it would be nice if there were occasional > saved check points from where i can restart > the fuzzer. > > i dont yet see the bug and cannot reproduce the > issue outside the fuzzer (but i didnt try very hard) > > attached the fuzz test case and the code that should > reproduce the issue, gdb session below > > Core was generated by `./a.out -seed=1753234605'. > Program terminated with signal SIGBUS, Bus error. > #0 0x000000000047a05b in inet_pton (af=, s=, a0=0x20000ffffe000) at src/network/inet_pton.c:65 > 65 *a++ = ip[j]>>8; > (gdb) bt > #0 0x000000000047a05b in inet_pton (af=, s=, a0=0x20000ffffe000) at src/network/inet_pton.c:65 > #1 0x0000000000400769 in TestOneInput () > #2 0x000000000040c6f3 in fuzzer::Fuzzer::RunOneMaximizeTotalCoverage(std::vector > const&) () > #3 0x000000000040c412 in fuzzer::Fuzzer::RunOne(std::vector > const&) () > #4 0x000000000040cc7c in fuzzer::Fuzzer::MutateAndTestOne(std::vector >*) () > #5 0x000000000040cffb in fuzzer::Fuzzer::Loop(unsigned long) () > #6 0x0000000000400d4c in fuzzer::FuzzerDriver(int, char**, void (*)(unsigned char const*, unsigned long)) () > #7 0x00000000004007dc in main () > (gdb) disass inet_pton,+40 > Dump of assembler code from 0x479b40 to 0x479b68: > 0x0000000000479b40 : push %rbp > 0x0000000000479b41 : push %r15 > 0x0000000000479b43 : push %r14 > 0x0000000000479b45 : push %r13 > 0x0000000000479b47 : push %r12 > 0x0000000000479b49 : push %rbx > 0x0000000000479b4a : sub $0x28,%rsp > 0x0000000000479b4e : mov %rdx,%r13 > 0x0000000000479b51 : mov %rsi,%r14 > 0x0000000000479b54 : mov %edi,%ebp > 0x0000000000479b56 : mov $0x6de364,%edi > 0x0000000000479b5b : callq 0x4007f0 <__sanitizer_cov_with_check> > 0x0000000000479b60 : cmp $0xa,%ebp > 0x0000000000479b63 : jne 0x479ba6 > 0x0000000000479b65 : mov $0x6de3c8,%edi > End of assembler dump. > (gdb) disass /m 0x000000000047a020,+64 > Dump of assembler code from 0x47a020 to 0x47a060: > 62 for (j=0; j<7-i; j++) ip[brk+j] = 0; > 0x000000000047a02a : callq 0x4007f0 <__sanitizer_cov_with_check> > 0x000000000047a02f : xor %ebx,%ebx > 0x000000000047a031 : mov 0x8(%rsp),%rbp > 0x000000000047a036 : mov 0x4(%rsp),%r15d > 0x000000000047a03b : jmp 0x47a04d > 0x000000000047a03d : nopl (%rax) > > 63 } > 64 for (j=0; j<8; j++) { > 0x000000000047a040 : inc %rbx > 0x000000000047a043 : mov $0x6de46c,%edi > 0x000000000047a048 : callq 0x4007f0 <__sanitizer_cov_with_check> > 0x000000000047a04d : mov $0x6de468,%edi > > 65 *a++ = ip[j]>>8; > 0x000000000047a052 : callq 0x4007f0 <__sanitizer_cov_with_check> > 0x000000000047a057 : mov 0x11(%rsp,%rbx,2),%al > => 0x000000000047a05b : mov %al,0x0(%rbp,%rbx,2) > > 66 *a++ = ip[j]; > 0x000000000047a05f : mov 0x10(%rsp,%rbx,2),%al > 0x000000000047a063 : mov %al,0x1(%rbp,%rbx,2) > > End of assembler dump. > (gdb) i reg > rax 0x7fffffffdf00 140737488346880 > rbx 0x0 0 > rcx 0x0 0 > rdx 0x0 0 > rsi 0x7fffffffdfb2 140737488347058 > rdi 0x6de468 7201896 > rbp 0x20000ffffe000 0x20000ffffe000 > rsp 0x7fffffffdf80 0x7fffffffdf80 > r8 0x7fffffffdf3a 140737488346938 > r9 0x0 0 > r10 0x0 0 > r11 0x246 582 > r12 0x10 16 > r13 0x7 7 > r14 0x6e2dc3 7220675 > r15 0x1 1 > rip 0x47a05b 0x47a05b > eflags 0x10202 [ IF RF ] > cs 0x33 51 > ss 0x2b 43 > ds 0x0 0 > es 0x0 0 > fs 0x63 99 > gs 0x0 0 > (gdb) p (char*)0x6e2dc3 > $3 = 0x6e2dc3 "2.8288;3:33::2.82.83333" > (gdb)