https://bugzilla.redhat.com/show_bug.cgi?id=2058212
Bug ID: 2058212 Summary: stack-overflow in do_ea in disasm.c:377, ndisasm in the latest version of nasm Product: Fedora Version: 36 Status: NEW Component: nasm Assignee: dominik@greysector.net Reporter: zhengh@nipc.org.cn QA Contact: extras-qa@fedoraproject.org CC: dominik@greysector.net, java-sig-commits@lists.fedoraproject.org, mizdebsk@redhat.com, pbonzini@redhat.com Target Milestone: --- Classification: Fedora
Created attachment 1863189 --> https://bugzilla.redhat.com/attachment.cgi?id=1863189&action=edit poc
Description of problem: nasm's disasm has a stack-overflow in disasm.c:377 function do_ea.
Version-Release number of selected component (if applicable): latest commit 3f9fc2a3a7134936cbbae5780beb4319694f702a
How reproducible: export CFLAGS="-fsanitize=address -g" export CC=clang ./autogen.sh ./configure --disable-shared make -j8 ./ndisasm ./stack_overflow.1
==1251159==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd083b8240 at pc 0x0000004d51e6 bp 0x7ffd083b5d60 sp 0x7ffd083b5d58 READ of size 1 at 0x7ffd083b8240 thread T0 #0 0x4d51e5 in do_ea /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38 #1 0x4cf302 in matches /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:675:20 #2 0x4ca0a0 in disasm /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:1345:23 #3 0x4c471b in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:323:22 #4 0x7f9603c7efcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #5 0x7f9603c7f07c in __libc_start_main csu/../csu/libc-start.c:409:3 #6 0x41c2d4 in _start (/home/kdsj/workspace/benchmarks/reproduce/nasm/ndisasm+0x41c2d4)
Address 0x7ffd083b8240 is located in stack of thread T0 at offset 96 in frame #0 0x4c278f in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:84
This frame has 6 object(s): [32, 96) 'buffer' (line 85) <== Memory access at offset 96 overflows this variable [128, 136) 'ep' (line 85) [160, 416) 'outbuf' (line 86) [480, 484) 'synclen' (line 89) [496, 516) 'prefer' (line 95) [560, 561) 'rn_error' (line 96) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38 in do_ea Shadow bytes around the buggy address: 0x10002106eff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f030: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 =>0x10002106f040: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 00 f2 f2 f2 0x10002106f050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f070: f2 f2 f2 f2 f2 f2 f2 f2 04 f2 00 00 04 f2 f2 f2 0x10002106f080: f2 f2 01 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb
Additional info:
This bug is reported by nipc(http://www.nipc.org.cn/).
https://bugzilla.redhat.com/show_bug.cgi?id=2058212
Dominik 'Rathann' Mierzejewski dominik@greysector.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |FutureFeature, Security Doc Type|--- |If docs needed, set a value Flags| |needinfo?(zhengh@nipc.org.c | |n) Version|36 |rawhide
--- Comment #1 from Dominik 'Rathann' Mierzejewski dominik@greysector.net --- Is this the same as one of https://bugzilla.nasm.us/show_bug.cgi?id=3392810 https://bugzilla.nasm.us/show_bug.cgi?id=3392811 https://bugzilla.nasm.us/show_bug.cgi?id=3392812 ? All three above were reported by you.
https://bugzilla.redhat.com/show_bug.cgi?id=2058212
Han Zheng zhengh@nipc.org.cn changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(zhengh@nipc.org.c | |n) |
--- Comment #2 from Han Zheng zhengh@nipc.org.cn --- Yes, it's duplicated with the first report.
The following 3 reports come from my lab mate who was testing my new fuzzer. I'll ask them to verify if it's deduplicated before submitting the new reports.
https://bugzilla.redhat.com/show_bug.cgi?id=2058212
Dominik 'Rathann' Mierzejewski dominik@greysector.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |https://bugzilla.nasm.us/sh | |ow_bug.cgi?id=3392810
--- Comment #3 from Dominik 'Rathann' Mierzejewski dominik@greysector.net --- Thanks for the quick answer!
https://bugzilla.redhat.com/show_bug.cgi?id=2058212
Dominik 'Rathann' Mierzejewski dominik@greysector.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |CURRENTRELEASE Status|NEW |CLOSED Fixed In Version| |nasm-2.16.01-1.fc38 Last Closed| |2024-12-09 13:41:35
--- Comment #4 from Dominik 'Rathann' Mierzejewski dominik@greysector.net --- Fixed in 2.16.01: https://bugzilla.nasm.us/show_bug.cgi?id=3392810#c1 .
java-sig-commits@lists.fedoraproject.org