[no subject]

Dear developers,

I’m a security researcher and I am trying my new fuzzers. I’ve just found a memory leak in the latest commit of the ncurse. Here are the details.

Environment

Ubuntu 16.04

GCC 7.5

Version ncurses-6.3-20220704

Step to reproduce

export CFLAGS="-fsanitize=address -g"

export CXXFLAGS="-fsanitize=address -g"

./configure

make -j$(nproc)

./prog/tic -o /dev/null bug1

ASAN report

"bug1", line 2, col 0, terminal '88X7VKLO6CCV6688': Missing separator
"bug1", line 2, col 1058, terminal '6': older tic versions may treat the description field as an alias
"bug1", line 2, col 1480, terminal '6': Illegal character - '~N'
"bug1", line 2, col 1480, terminal '6': unknown capability '08WK486YQL2SP3R0IVZ21OUX7AVEIB0ZLFAR6LVHQ0QXMBWXYGW1DCVHG
M9LEQ3FT3VW5UQWV0DA78H59DEBL7MU8GVJVX942SKKFOQCZERRBQY4FKFRC3U0IJQZ8RTWYZ3JQJV3F0X7BQ0EKWD0MP3SQJNAW4B4CFU8CCAMJ2YHZT
TSWTZ5ERHNN999SJDZQW38YWWQYT7Q1FJZ7RXRVEMCQXIYQY85LNS24d12JDKYG7QMEM80ARSZ8DMSDQB3SFQQYGH2VAPXNY6GMXOSOI77WVEL7RRTF94
N22JEYF4518VGIP38N4SB3QW1E5GO31GMNUNP7MK1ZW648XIKIGARAVXJD20YXUH1ZAGUCVNNAR9KOQM0JR39EUVFVASKLYAHT3NLA1KN8X7A7Y8J8Y4L
CK13FJUUIUC17'
"bug1", line 2, col 1704, terminal '6': Illegal character - '!'
"bug1", line 2, col 1704, terminal '6': unknown capability 'V0UCDBKP856G75IVM7IDT814OVMZNF6QLLL9QF13CRIVCOmB6W7XKAV45
C8CR5HHYJ4DH72S6Y3I71Q1HIHEGO1369AI0ZFQ8JVW4YUXCN8JOROE9CY2K963T0ZNUQFF1TNWFCJ0TARBB7PF139HKWVUADRLUIBNZU30HLXJLVWDJ2
QZQYRQ40Z623O0DcR4293MAOd79B3GW48C801EUCM0KVJHLZM'
"bug1", line 2, col 1813, terminal '6': Illegal character - ')'
"bug1", line 2, col 1813, terminal '6': unknown capability 'X74WUT3L463ET2LD3CH2YTPVXJJ805T3BNQY401VMBSLGH55XXK8DQ5P4
399MRJU9CXGVR31EVM71PUHGH2MHA3A4XLDB8GI26JZ4VG6ZCY6'
"bug1", line 2, col 1901, terminal '6': Illegal character - '~\'
"bug1", line 2, col 1901, terminal '6': unknown capability '8F94H26JL8B0EZR8QOOTNWKI8VA9IXND1JHE8MAG80C6B64V65O52T4MU
5O52T4MUROE7WHVXK8INP12CINU050'
"bug1", line 2, col 1994, terminal '6': Illegal character - '^?'
"bug1", line 2, col 1994, terminal '6': unknown capability '20MUC35FQ58AEO2SUVJMPT2YAQ3R0MGC6VDQPNURPIJXLC4ALJV723HX8
SCMV4T4VXXPWS8GMM4RSOQJQ715EAU97AXX'
"bug1", line 2, col 2067, terminal '6': Illegal character - 'M-z'
"bug1", line 2, col 2067, terminal '6': unknown capability 'WQJBYTEMIAI5IIUULXR5FRKMYT207T0V67QKEaMIHYLWBEM07Y8V497FW
IQYRCT8KP61O7T3'
"bug1", line 2, col 2197, terminal '6': no value given for `LFTOC9GCDZUU8V65JzOH1ULXR5FRKMYT207T0V67QKEFMIHYLWBEM07Y8
V497FWIQYRCT8KP61O7T3HGXHATVRMKDRH752K3XCO2K6HW38ALMKI4ARHKE2L9OJY1'
"bug1", line 2, col 2197, terminal '6': Missing separator for `LFTOC9GCDZUU8V65JzOH1ULXR5FRKMYT207T0V67QKEFMIHYLWBEM0
7Y8V497FWIQYRCT8KP61O7T3HGXHATVRMKDRH752K3XCO2K6HW38ALMKI4ARHKE2L9OJY1'
"bug1", line 2, col 2197, terminal '6': wrong type used for string capability 'LFTOC9GCDZUU8V65JzOH1ULXR5FRKMYT207T0V
67QKEFMIHYLWBEM07Y8V497FWIQYRCT8KP61O7T3HGXHATVRMKDRH752K3XCO2K6HW38ALMKI4ARHKE2L9OJY1'
"bug1", line 3, terminal '88X7VKLO6CCV6688': corrupt data found in convert_strings

=================================================================
==15156==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 3312 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6ef9b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
    #1 0x43d571 in _nc_init_termtype ../ncurses/./tinfo/read_entry.c:232
    #2 0x4682c8 in _nc_init_entry ../ncurses/./tinfo/alloc_entry.c:81
    #3 0x45282e in _nc_parse_entry ../ncurses/./tinfo/parse_entry.c:299
    #4 0x4499c2 in _nc_read_entry_source ../ncurses/./tinfo/comp_parse.c:234
    #5 0x405d65 in main ../progs/tic.c:964
    #6 0x7ffff6a7183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

Direct leak of 514 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6ef9b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
    #1 0x462800 in copy_termtype ../ncurses/./tinfo/alloc_ttype.c:575
    #2 0x462f93 in _nc_copy_termtype ../ncurses/./tinfo/alloc_ttype.c:674
    #3 0x469a67 in _nc_merge_entry ../ncurses/./tinfo/alloc_entry.c:259
    #4 0x44af52 in _nc_resolve_uses2 ../ncurses/./tinfo/comp_parse.c:572
    #5 0x405da6 in main ../progs/tic.c:972
    #6 0x7ffff6a7183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

Direct leak of 78 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6ef9b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
    #1 0x43d509 in _nc_init_termtype ../ncurses/./tinfo/read_entry.c:230
    #2 0x4682c8 in _nc_init_entry ../ncurses/./tinfo/alloc_entry.c:81
    #3 0x45282e in _nc_parse_entry ../ncurses/./tinfo/parse_entry.c:299
    #4 0x4499c2 in _nc_read_entry_source ../ncurses/./tinfo/comp_parse.c:234
    #5 0x405d65 in main ../progs/tic.c:964
    #6 0x7ffff6a7183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

Direct leak of 44 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6ef9b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
    #1 0x43d4a1 in _nc_init_termtype ../ncurses/./tinfo/read_entry.c:228
    #2 0x4682c8 in _nc_init_entry ../ncurses/./tinfo/alloc_entry.c:81
    #3 0x45282e in _nc_parse_entry ../ncurses/./tinfo/parse_entry.c:299
    #4 0x4499c2 in _nc_read_entry_source ../ncurses/./tinfo/comp_parse.c:234
    #5 0x405d65 in main ../progs/tic.c:964
    #6 0x7ffff6a7183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

Direct leak of 18 byte(s) in 1 object(s) allocated from:
    #0 0x7ffff6ef9b80 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb80)
    #1 0x462800 in copy_termtype ../ncurses/./tinfo/alloc_ttype.c:575
    #2 0x462f93 in _nc_copy_termtype ../ncurses/./tinfo/alloc_ttype.c:674
    #3 0x469a67 in _nc_merge_entry ../ncurses/./tinfo/alloc_entry.c:259
    #4 0x44b000 in _nc_resolve_uses2 ../ncurses/./tinfo/comp_parse.c:580
    #5 0x405da6 in main ../progs/tic.c:972
    #6 0x7ffff6a7183f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2083f)

SUMMARY: AddressSanitizer: 3966 byte(s) leaked in 5 allocation(s).

Sent from Mail for Windows

From:	邓朋
Subject:
Date:	Mon, 5 Dec 2022 16:22:24 +0000