Invalid memory read / heap out of bounds in parse_top_node_line()

[Hanno Böck]

Hi,

The attached file will cause an out of bounds heap read in the
function parse_top_node_line.
To see this you need a memory safety detection tool like valgrind or
address sanitizer (add "-fsanitize=address" to CFLAGS+LDFLAGS).

This was found with the tool american fuzzy lop.


Here's a stack trace from address sanitizer (latest svn code):

==4818==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000dd9d 
at pc 0x00000051c1dd bp 0x7fff7ca0ad10 sp 0x7fff7ca0ad08
READ of size 1 at 0x60200000dd9d thread T0
    #0 0x51c1dc in parse_top_node_line 
/f/texinfo/trunk/info/info-utils.c:1174:11
    #1 0x51c1dc in scan_node_contents /f/texinfo/trunk/info/info-utils.c:1646
    #2 0x53d816 in info_node_of_tag_ext /f/texinfo/trunk/info/nodes.c:1445:11
    #3 0x53bada in info_node_of_tag /f/texinfo/trunk/info/nodes.c:1486:10
    #4 0x53bada in info_get_node_of_file_buffer 
/f/texinfo/trunk/info/nodes.c:1110
    #5 0x53b289 in info_get_node_with_defaults 
/f/texinfo/trunk/info/nodes.c:993:14
    #6 0x55ef41 in dump_node_to_stream /f/texinfo/trunk/info/session.c:3765:10
    #7 0x55ec52 in dump_nodes_to_file /f/texinfo/trunk/info/session.c:3728:11
    #8 0x5227b0 in main /f/texinfo/trunk/info/info.c:1027:7
    #9 0x7f2aa5adc78f in __libc_start_main (/lib64/libc.so.6+0x2078f)
    #10 0x419b28 in _start (/r/texinfo/ginfo+0x419b28)

0x60200000dd9d is located 0 bytes to the right of 13-byte region 
[0x60200000dd90,0x60200000dd9d)
allocated by thread T0 here:
    #0 0x4c1758 in malloc (/r/texinfo/ginfo+0x4c1758)
    #1 0x58254e in xmalloc /f/texinfo/trunk/gnulib/lib/xmalloc.c:41:13

SUMMARY: AddressSanitizer: heap-buffer-overflow 
/f/texinfo/trunk/info/info-utils.c:1174:11 in parse_top_node_line
Shadow bytes around the buggy address:
  0x0c047fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9b90: fa fa fd fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x0c047fff9ba0: fa fa 04 fa fa fa fd fa fa fa fd fd fa fa fd fd
=>0x0c047fff9bb0: fa fa 00[05]fa fa 04 fa fa fa 04 fa fa fa fd fd
  0x0c047fff9bc0: fa fa 02 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9bd0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff9be0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c047fff9bf0: fa fa fd fd fa fa 00 00 fa fa fd fd fa fa fd fd
  0x0c047fff9c00: fa fa fd fd fa fa fd fa fa fa 00 04 fa fa 00 04
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==4818==ABORTING


-- 
Hanno Böck
https://hboeck.de/

mail/jabber: address@hidden
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

texinfo-oob-heap-parse_top_node_line.info
Description: Binary data

pgpg9fBS5rrm6.pgp
Description: OpenPGP digital signature