Re: An illegal memory access in ncurses, tic

[郑晗]

Thanks for your confirm and reply. 

I've tried the latest commit with all the existing pocs, it seems that the 
patch works. 

I'll keep running my fuzzer with patched program and update in this mail list 
once some new seeds bypass the patch.


> -----原始邮件-----
&gt; 发件人: "Thomas Dickey" <dickey@his.com>
&gt; 发送时间: 2022-04-17 07:35:09 (星期日)
&gt; 收件人: "郑晗" <zhenghan20@mails.ucas.ac.cn>
&gt; 抄送: bug-ncurses@gnu.org
&gt; 主题: Re: An illegal memory access in ncurses, tic
&gt; 
&gt; On Sat, Apr 16, 2022 at 04:55:06PM -0400, Thomas Dickey wrote:
&gt; &gt; On Sat, Apr 16, 2022 at 09:19:48PM +0800, 郑晗 wrote:
&gt; &gt; &gt; Dear developers,
&gt; &gt; &gt; 
&gt; &gt; &gt; I'm a security researcher and is now trying to test my new 
fuzzer. I've just found an illegal memory access in the latest commit of 
ncurse, tic. Here are the informations:
&gt; &gt; &gt; 
&gt; &gt; &gt; (1) environment
&gt; &gt; &gt; Ubuntu 20.04.3 LTS
&gt; &gt; &gt; gcc 9.3.0
&gt; &gt; &gt; ncurse latest commit 74b10d4a30eec8feb66a4b94a72da65be0048447, 
tag v6_3_20220409
&gt; &gt; &gt; 
&gt; &gt; &gt; 
&gt; &gt; &gt; (2) step to reproduce: 
&gt; &gt; &gt; export CFLAGS="-fsanitze=address -g"
&gt; &gt; &gt; export CXXFLAGS="-fsanitize=address -g"
&gt; &gt; &gt; ./configure &amp;&amp; make -j$(nproc)
&gt; &gt; &gt; ./prog/tic -o /dev/null $POC
&gt; &gt; 
&gt; &gt; I can reproduce the problem, but the command is incorrect.
&gt; &gt; With that command, tic will exit (because /dev/null is not a 
directory)
&gt; &gt; before getting into the area which produces these messages.
&gt; 
&gt; I have a simple fix for the immediate problem, but can see that there's
&gt; some additional (time-consuming) investigation needed.
&gt; 
&gt; -- 
&gt; Thomas E. Dickey <dickey@invisible-island.net>
&gt; https://invisible-island.net
&gt; ftp://ftp.invisible-island.net
</dickey@invisible-island.net></zhenghan20@mails.ucas.ac.cn></dickey@his.com>