Bug Report for ncurses 6.3.20220205

[1360434810]

Hi, developers of ncurses:
When I tested infotocap, I founda bug. I have provided all the POC file in the email attachment.

1. Step To Reproduce: ./infotocap -o /dev/null $POC

2. Environment: Ubuntu 22.04 (docker) and ncurses 6.3.20220205

3.BUGS

(1) BUG1

(base) ./infotocap -o /dev/null POC1

=================================================================

==91401==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55819d014f00 at pc 0x55819cf4cdc6 bp 0x7ffd7f271930 sp 0x7ffd7f271928

WRITE of size 1 at 0x55819d014f00 thread T0

    #0 0x55819cf4cdc5 in tparam_internal /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/ncurses/../ncurses/./tinfo/lib_tparm.c:856:4

    #1 0x55819cf4e022 in _nc_tiparm /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/ncurses/../ncurses/./tinfo/lib_tparm.c:1205:11

    #2 0x55819cf5922b in set_attribute_9 /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/ncurses/../ncurses/./tinfo/trim_sgr0.c:55:13

    #3 0x55819cf5922b in _nc_trim_sgr0 /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/ncurses/../ncurses/./tinfo/trim_sgr0.c:245:13

    #4 0x55819cf2bced in fmt_entry /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/progs/../progs/dump_entry.c:1089:22

    #5 0x55819cf330e7 in dump_entry /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/progs/../progs/dump_entry.c:1555:10

    #6 0x55819cf1422c in main /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/progs/../progs/tic.c:1042:7

    #7 0x7fe243bb6d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 89c3cb85f9e55046776471fed05ec441581d1969)

    #8 0x7fe243bb6e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 89c3cb85f9e55046776471fed05ec441581d1969)

    #9 0x55819ce54584 in _start (/AFLplusplus/aflplusplus_pro/programs_newest_version/unibench_asan/infotocap+0x6c584) (BuildId: ed7a6656f8a8edfa7901e5015c85b075a2c0f97f)

0x55819d014f00 is located 32 bytes to the left of global variable '_nc_prescreen' defined in '../ncurses/./tinfo/lib_data.c:237:39' (0x55819d014f20) of size 656

0x55819d014f00 is located 80 bytes to the right of global variable '_nc_globals' defined in '../ncurses/./tinfo/lib_data.c:119:37' (0x55819d014ce0) of size 464

SUMMARY: AddressSanitizer: global-buffer-overflow /AFLplusplus/kbench_aflplusplus_images/unibench_2022_10_13_version/unibench/ncurses/ncurses/../ncurses/./tinfo/lib_tparm.c:856:4 in tparam_internal

Shadow bytes around the buggy address:

  0x0ab0b39fa990: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00

  0x0ab0b39fa9a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39fa9b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39fa9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39fa9d0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9

=>0x0ab0b39fa9e0:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39fa9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39faa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39faa10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39faa20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  0x0ab0b39faa30: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9

Shadow byte legend (one shadow byte represents 8 application bytes):

  Addressable:           00

  Partially addressable: 01 02 03 04 05 06 07 

  Heap left redzone:       fa

  Freed heap region:       fd

  Stack left redzone:      f1

  Stack mid redzone:       f2

  Stack right redzone:     f3

  Stack after return:      f5

  Stack use after scope:   f8

  Global redzone:          f9

  Global init order:       f6

  Poisoned by user:        f7

  Container overflow:      fc

  Array cookie:            ac

  Intra object redzone:    bb

  ASan internal:           fe

  Left alloca redzone:     ca

  Right alloca redzone:    cb

==91401==ABORTING

---

1360434810 1360434810@qq.com

 

POS1
Description: Binary data