bugGNU nano - Bugs: bug #46348, heap overflow of one byte in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #46348: heap overflow of one byte in function parse_mbchar() with multibyte unicode characters

Submitter:  Hanno Boeck <hanno>
Submitted:  Sat 31 Oct 2015 02:58:24 PM UTC
   
 
Severity:  3 - Normal Status:  Duplicate
Assigned to:  bens Open/Closed:  Closed

Sat 31 Oct 2015 05:26:28 PM UTC, comment #3: 

I found this through normal use (currently trying to generate a Gentoo system built with address sanitizer).

But fuzzing also works, just replicated that, afl found the same issue within seconds. Seems if nano doesn't have a console it will parse the file and then quit because it can't open. That's exactly what you want for fuzzing, so it's straightforward.

I also tried fuzzing the latest nano svn (which has the fix). Nothing found yet, but if that changes I'll report it :-)

Hanno Boeck <hanno>
Sat 31 Oct 2015 05:11:04 PM UTC, comment #2: 

Thanks for reporting!  (I'll close the bug when a version containing the fix has been released.  I'm waiting for Chris to release 2.4.3 or 2.5.0.)

By the way, did you run into this bug by normal usage, or by fuzzing nano?  If the latter, how could I do that?

Benno Schulenberg <bens>
Group administrator
Sat 31 Oct 2015 03:21:08 PM UTC, comment #1: 

Apologies, I haven't checked the svn code. It seems this is already fixed with commit revision 5347 and this is actually a duplicate of bug #45718.

It seems I don't have permission to close this bug myself, so please feel free to close it.

Hanno Boeck <hanno>
Sat 31 Oct 2015 02:58:24 PM UTC, original submission:  

I noticed a write heap overflow in nano when typing in a $ and any 3-byte or 4-byte unicode char. On a US intl keyboard layout this can e.g. be achieved with altgr-0. But it can also just be tested with the attached file.

This can be seen with address sanitizer (-fsanitize=address CFLAGS) or with valgrind.

Address Sanitizer output:

==1254==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dcd2 at pc 0x4089b6 bp 0x7ffedca0fe20 sp 0x7ffedca0fe10
WRITE of size 1 at 0x60200000dcd2 thread T0
    #0 0x4089b5 in parse_mbchar /mnt/ram/nano-2.4.2/src/chars.c:422
    #1 0x467a61 in display_string /mnt/ram/nano-2.4.2/src/winio.c:1940
    #2 0x46d3d0 in update_line /mnt/ram/nano-2.4.2/src/winio.c:2887
    #3 0x46f644 in edit_refresh /mnt/ram/nano-2.4.2/src/winio.c:3210
    #4 0x410b3f in display_buffer /mnt/ram/nano-2.4.2/src/files.c:439
    #5 0x437bbf in main /mnt/ram/nano-2.4.2/src/nano.c:2786
    #6 0x7f1b2a2e460f in __libc_start_main (/lib64/libc.so.6+0x2060f)
    #7 0x404088 in _start (/mnt/ram/nano-2.4.2/src/nano+0x404088)

0x60200000dcd2 is located 0 bytes to the right of 2-byte region [0x60200000dcd0,0x60200000dcd2)
allocated by thread T0 here:
    #0 0x7f1b2ad62a76 in __interceptor_realloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.3/libasan.so.1+0x57a76)
    #1 0x4614ac in nrealloc /mnt/ram/nano-2.4.2/src/utils.c:398
    #2 0x460c91 in null_at /mnt/ram/nano-2.4.2/src/utils.c:126
    #3 0x46820e in display_string /mnt/ram/nano-2.4.2/src/winio.c:2005
    #4 0x46d3d0 in update_line /mnt/ram/nano-2.4.2/src/winio.c:2887
    #5 0x46f644 in edit_refresh /mnt/ram/nano-2.4.2/src/winio.c:3210
    #6 0x410b3f in display_buffer /mnt/ram/nano-2.4.2/src/files.c:439
    #7 0x437bbf in main /mnt/ram/nano-2.4.2/src/nano.c:2786
    #8 0x7f1b2a2e460f in __libc_start_main (/lib64/libc.so.6+0x2060f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/ram/nano-2.4.2/src/chars.c:422 parse_mbchar
Shadow bytes around the buggy address:
  0x0c047fff9b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9b90: fa fa fa fa fa fa fa fa fa fa[02]fa fa fa fd fa
  0x0c047fff9ba0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9bb0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9bc0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff9bd0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff9be0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe


Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #35348:  nano-heapoverflow-write-parse_mbchar added by hanno (4B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bens (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-12-07 bens Open/ClosedOpen Closed
    2015-10-31 bens StatusNone Duplicate
        Assigned toNone bens
        SummaryHeap overflow of one byte in function parse_mbchar with multibyte unicode characters heap overflow of one byte in function parse_mbchar() with multibyte unicode characters
    2015-10-31 hanno Attached File- Added nano-heapoverflow-write-parse_mbchar, #35348

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code