Re: AddressSanitizer: heap-buffer-overflow in rl_tilde_expand

[Eduardo A . Bustamante López]

On Thu, Jun 15, 2017 at 09:39:09AM -0500, Eduardo Bustamante wrote:
> Found by fuzzing `read -e' with AFL. The stacktrace reported by Address
> Sanitizer is followed by the base64 encoded crashing input.
> 
> 
> ==472==ERROR: AddressSanitizer: heap-buffer-overflow on address 
> 0x61100000977f at pc 0x562befba4a14 bp 0x7ffdee172bb0 sp 0x7ffdee172ba8
> READ of size 1 at 0x61100000977f thread T0
>     #0 0x562befba4a13 in rl_tilde_expand 
> (/home/dualbus/src/gnu/bash-build/bash+0x23ba13)

This one looks like an easy fix. When `start = 0', the loop ends up
dereferencing `rl_line_buffer[-1]'. Changing the order of the test does the 
trick.


dualbus@debian:~/src/gnu/bash$ git difftool -y -x 'diff -c' -- 
lib/readline/util.c 
*** /tmp/zFXFei_util.c  2017-06-16 09:34:03.958088209 -0500
--- lib/readline/util.c 2017-06-16 09:33:09.384638705 -0500
***************
*** 193,199 ****
      }
    else if (start >= 0 && rl_line_buffer[start] != '~')
      {
!       for (; !whitespace (rl_line_buffer[start]) && start >= 0; start--)
          ;
        start++;
      }
--- 193,199 ----
      }
    else if (start >= 0 && rl_line_buffer[start] != '~')
      {
!       for (; start >= 0 && !whitespace (rl_line_buffer[start]); start--)
          ;
        start++;
      }

-- 
Eduardo Bustamante
https://dualbus.me/