AddressSanitizer: heap-buffer-overflow in rl_delete

[Eduardo Bustamante]

Found by fuzzing `read -e' with AFL. The stacktrace reported by Address
Sanitizer is followed by the base64 encoded crashing input.


==1736==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000009880 
at pc 0x7f464da3a063 bp 0x7ffe86032fe0 sp 0x7ffe86032790
READ of size 115 at 0x611000009880 thread T0
    #0 0x7f464da3a062  (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x3c062)
    #1 0x5634e38634c3 in _rl_find_next_mbchar_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x25d4c3)
    #2 0x5634e3864375 in _rl_find_next_mbchar 
(/home/dualbus/src/gnu/bash-build/bash+0x25e375)
    #3 0x5634e3850c0e in rl_delete 
(/home/dualbus/src/gnu/bash-build/bash+0x24ac0e)
    #4 0x5634e380230d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #5 0x5634e3801ee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #6 0x5634e3801727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #7 0x5634e38017b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #8 0x5634e38017dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #9 0x5634e3800e93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #10 0x5634e37bc136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #11 0x5634e37b9aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #12 0x5634e36cfc89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #13 0x5634e36d189f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #14 0x5634e36cf11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #15 0x5634e36bcf42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #16 0x5634e36c582e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #17 0x5634e36bdd17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #18 0x5634e37a70f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #19 0x5634e3688401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #20 0x5634e36868da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #21 0x7f464d2522b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #22 0x5634e3685749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x611000009880 is located 0 bytes to the right of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7f464dabfd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x5634e3795d95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x5634e3803220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x5634e38030c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x5634e3770c28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x5634e37bc096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x5634e37b9aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x5634e36cfc89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x5634e36d189f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x5634e36cf11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x5634e36bcf42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x5634e36c582e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x5634e36bdd17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x5634e37a70f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x5634e3688401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x5634e36868da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7f464d2522b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/usr/lib/x86_64-linux-gnu/libasan.so.3+0x3c062) 
Shadow bytes around the buggy address:
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff9310:[fa]fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c227fff9340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9360: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1736==ABORTING

INPUT
G1AKIQMMAgIAgGA8PD0LACQbJCckoAAJAAIAr1wJCT8kJySgAAkAAgCvXAkJYycgYww8PH89CyBg
BEADFRlWPEkA/wEbU4ChPAtJ//t//4A8PQtAPBkQIjyAPDwAARsAIAQgAP8AgBkQAAAAAGRgBFr9
/wAAAADoGRAAPDw8EfyOAID/9K6urq6urq6uk66urq6urq6urq6urq6uva6uYARAAxUTVjxJAIA8
QBn8GwAgBACOjv8g//+Ojo486BkQAAAAAGRgBFoD6AAAfQRAA+g8PBkQACRSUlJSUoBSUlJSUlJS
UlJSUlJSUlJSUlJSUlJSUlJSbvIbBQ==

-- 
Eduardo Bustamante
https://dualbus.me/