bugGNU patch - Bugs: bug #54558, out of bounds memory read on...

 
 

bug #54558: out of bounds memory read on malformed patch

Submitter:  Hanno Boeck <hanno>
Submitted:  Thu 23 Aug 2018 09:12:12 AM UTC
   
 
Category:  Parser / Internal Representation Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 28 Jul 2019 03:04:34 PM UTC, comment #1: 

Fixed by this commit:

  Avoid invalid memory access in context format diffs

Andreas Gruenbacher <agruen>
Group administrator
Thu 23 Aug 2018 09:12:12 AM UTC, original submission:  

Attached file will trigger an out of bounds memory read in the function another_hunk, detectable with asan.

ASAN stack trace:

==30482==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000003f at pc 0x0000005117c3 bp 0x7ffeca1c33d0 sp 0x7ffeca1c33c8
READ of size 1 at 0x60c00000003f thread T0
    #0 0x5117c2 in another_hunk /f/patch/patch/src/pch.c:1332:27
    #1 0x4f7320 in main /f/patch/patch/src/patch.c:397:25
    #2 0x7f1016838ae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)
    #3 0x41c889 in _start (/r/patch/patch+0x41c889)

0x60c00000003f is located 1 bytes to the left of 125-byte region [0x60c000000040,0x60c0000000bd)
allocated by thread T0 here:
    #0 0x4bf323 in malloc (/r/patch/patch+0x4bf323)
    #1 0x56196f in xmalloc /f/patch/patch/lib/xmalloc.c:41:13
    #2 0x5064d4 in intuit_diff_type /f/patch/patch/src/pch.c:796:12
    #3 0x5064d4 in there_is_another_patch /f/patch/patch/src/pch.c:240
    #4 0x4f2ad7 in main /f/patch/patch/src/patch.c:197:2
    #5 0x7f1016838ae6 in __libc_start_main (/lib64/libc.so.6+0x21ae6)


Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by agruen (Updated the item)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-07-28 agruen StatusNone Fixed
        Open/ClosedOpen Closed
    2019-07-28 agruen CategoryNone Parser / Internal Representation
    2018-08-23 hanno Attached File- Added gnu-patch-oob-another_hunk.patch, #44832

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code