bug-bash
[Top][All Lists]
Advanced
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

AddressSanitizer: heap-buffer-overflow in rl_tilde_expand

From: Eduardo Bustamante
Subject: AddressSanitizer: heap-buffer-overflow in rl_tilde_expand
Date: Thu, 15 Jun 2017 09:39:09 -0500
User-agent: NeoMutt/20170113 (1.7.2) 
Found by fuzzing `read -e' with AFL. The stacktrace reported by Address
Sanitizer is followed by the base64 encoded crashing input.


==472==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000977f 
at pc 0x562befba4a14 bp 0x7ffdee172bb0 sp 0x7ffdee172ba8
READ of size 1 at 0x61100000977f thread T0
    #0 0x562befba4a13 in rl_tilde_expand 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13)
    #1 0x562befb6530d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #2 0x562befb65aef in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fcaef)
    #3 0x562befb64ee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #4 0x562befb64727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #5 0x562befb647b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #6 0x562befb647dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #7 0x562befb63e93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #8 0x562befb1f136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #9 0x562befb1caa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #10 0x562befa32c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #11 0x562befa3489f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #12 0x562befa3211f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #13 0x562befa1ff42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #14 0x562befa2882e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #15 0x562befa20d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #16 0x562befb0a0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #17 0x562bef9eb401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #18 0x562bef9e98da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #19 0x7f1c9c5ec2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #20 0x562bef9e8749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x61100000977f is located 1 bytes to the left of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7f1c9ce59d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x562befaf8d95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x562befb66220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x562befb660c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x562befad3c28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x562befb1f096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x562befb1caa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x562befa32c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x562befa3489f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x562befa3211f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x562befa1ff42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x562befa2882e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x562befa20d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x562befb0a0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x562bef9eb401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x562bef9e98da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7f1c9c5ec2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13) in rl_tilde_expand
Shadow bytes around the buggy address:
  0x0c227fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9310: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==472==ABORTING

INPUT
KHo0jwAIAREB/wsLYJgAABsbGyYA1SiUYID//Qf6IhoaGFIIIhsbGwC8JLMoKCgoKCgoKCgoKCgd
Hh6Af4lN6QASixIEAQAAABkAAFKOpPsZVtEAHMgEQAADFRlWPCgqKB4eHgEzHhk8gzwA/Klo5gIA
jqQ8GVbRSf///wD/YARbHgQEQAAgIFo9CH84PBAgEAAkABAAAgAAH/q8PD0LQCEZ/n8AsBkAQwD8
jjwZEAA8/yokUo6k+xlW0QAcyARAAAMVGVY8KCooKAYoKCgoKCgoKCgoKCgoHR4eHhgxnGA8Iz0L
QCYZEABkHjkA/AEeHhnr6+vr6+vr6+s76gQC8jwAIAABfQQyf/wZENn5BQ==



==488==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000977f 
at pc 0x558cdb461a14 bp 0x7ffe642cea60 sp 0x7ffe642cea58
READ of size 1 at 0x61100000977f thread T0
    #0 0x558cdb461a13 in rl_tilde_expand 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13)
    #1 0x558cdb42230d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #2 0x558cdb422aef in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fcaef)
    #3 0x558cdb421ee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #4 0x558cdb421727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #5 0x558cdb4217b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #6 0x558cdb4217dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #7 0x558cdb420e93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #8 0x558cdb3dc136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #9 0x558cdb3d9aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #10 0x558cdb2efc89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #11 0x558cdb2f189f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #12 0x558cdb2ef11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #13 0x558cdb2dcf42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #14 0x558cdb2e582e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #15 0x558cdb2ddd17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #16 0x558cdb3c70f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #17 0x558cdb2a8401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #18 0x558cdb2a68da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #19 0x7f54e159f2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #20 0x558cdb2a5749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x61100000977f is located 1 bytes to the left of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7f54e1e0cd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x558cdb3b5d95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x558cdb423220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x558cdb4230c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x558cdb390c28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x558cdb3dc096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x558cdb3d9aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x558cdb2efc89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x558cdb2f189f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x558cdb2ef11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x558cdb2dcf42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x558cdb2e582e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x558cdb2ddd17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x558cdb3c70f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x558cdb2a8401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x558cdb2a68da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7f54e159f2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13) in rl_tilde_expand
Shadow bytes around the buggy address:
  0x0c227fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c227fff92b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9310: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==488==ABORTING

INPUT
GwMWGOUkexvlQECwAAAoABsbGyYA1SiUYIT/2wf6IhoaGNMIIhsbGwC8JLMoKCgoKCgoKCgoKCgd
Hh6Af4lN6QASixIECQAAABkAAABAJzsAAoAAAAB/APb/Av8A/x4eHgEjHo6kPBlW0Un///////8A
AABkBEAAAyBaZAh/ODwQIBAAHQAQAAIAAB/6AAEACEAhGf5/AI6OozwLLz0LQFVA/BsAoAAABDwZ
GPgZGRkZGRkuGRkZGRkAQwDcjjwZEAA8/yokZ46k+xlW0QAcyARAAAMVGVY8KCooKSgoKCgoKCgo
KCgoKCgoHR4eHhgxnGD/fz0LQCYZEABkHjkA/NMeJFKOpPsZVtEAHMgEQAADFRlWIAABfQAyf/wZ
ENobBQ==



==2949==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000977f 
at pc 0x560954d2ca14 bp 0x7ffefe326770 sp 0x7ffefe326768
READ of size 1 at 0x61100000977f thread T0
    #0 0x560954d2ca13 in rl_tilde_expand 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13)
    #1 0x560954ced30d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #2 0x560954cedaef in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fcaef)
    #3 0x560954cecee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #4 0x560954cec727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #5 0x560954cec7b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #6 0x560954cec7dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #7 0x560954cebe93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #8 0x560954ca7136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #9 0x560954ca4aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #10 0x560954bbac89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #11 0x560954bbc89f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #12 0x560954bba11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #13 0x560954ba7f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #14 0x560954bb082e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #15 0x560954ba8d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #16 0x560954c920f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #17 0x560954b73401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #18 0x560954b718da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #19 0x7f4c2e4d02b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #20 0x560954b70749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x61100000977f is located 1 bytes to the left of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7f4c2ed3dd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x560954c80d95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x560954cee220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x560954cee0c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x560954c5bc28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x560954ca7096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x560954ca4aa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x560954bbac89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x560954bbc89f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x560954bba11f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x560954ba7f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x560954bb082e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x560954ba8d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x560954c920f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x560954b73401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x560954b718da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7f4c2e4d02b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13) in rl_tilde_expand
Shadow bytes around the buggy address:
  0x0c227fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9310: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==2949==ABORTING

INPUT
/wIbLbUA/38QGDsYFRwYGBkYGJgYGBj4Fy8wGAAAAEAEEe8Y+xcYGRg9C0AAlGBhaPwe/4AAAFNg
PDxgPgRAAANAABhVKDYbLUo3Gy00GH/tHjAYAABkNzY2gAAbJjc3GwAAgAAtNDYlNjY2NjY3NjaA
ABsmNzcbLRh//x8AAYAAGwo=



==3283==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000977f 
at pc 0x5643be3e6a14 bp 0x7ffc4973af60 sp 0x7ffc4973af58
READ of size 1 at 0x61100000977f thread T0
    #0 0x5643be3e6a13 in rl_tilde_expand 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13)
    #1 0x5643be3a730d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #2 0x5643be3a7aef in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fcaef)
    #3 0x5643be3a6ee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #4 0x5643be3a6727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #5 0x5643be3a67b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #6 0x5643be3a67dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #7 0x5643be3a5e93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #8 0x5643be361136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #9 0x5643be35eaa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #10 0x5643be274c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #11 0x5643be27689f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #12 0x5643be27411f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #13 0x5643be261f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #14 0x5643be26a82e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #15 0x5643be262d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #16 0x5643be34c0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #17 0x5643be22d401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #18 0x5643be22b8da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #19 0x7fc442cb52b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #20 0x5643be22a749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x61100000977f is located 1 bytes to the left of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7fc443522d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x5643be33ad95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x5643be3a8220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x5643be3a80c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x5643be315c28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x5643be361096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x5643be35eaa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x5643be274c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x5643be27689f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x5643be27411f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x5643be261f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x5643be26a82e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x5643be262d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x5643be34c0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x5643be22d401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x5643be22b8da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7fc442cb52b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13) in rl_tilde_expand
Shadow bytes around the buggy address:
  0x0c227fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9310: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3283==ABORTING

INPUT
GyIWKBsmSIFcXlxcRugDXFxGxVz8Gv9+7BsbGxsbGxsbbRs+GxsABBsrGwAAGhqIiIiIiIiIiIiI
iIiIiIiIiIh/iIiIiIiIiIiIiIgaBd8A2x8bFBQUFRQUAGdnZ2dnfmcZGRkZGV8ZGRkZGTUZGRkB
GRkUFABnZ2dnUmdnGRmjnaPgfwDfAOwiFBUUFABnZ2dnZ354GRkZGRlfGRkZGRk1GRkZARkZjhsU
BBshjo6OGxsbExsbAAAD6BQVFBQbFAQbBRsbGxQEFBQ=



==3340==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61100000977f 
at pc 0x5633b4c76a14 bp 0x7fff8bd3f650 sp 0x7fff8bd3f648
READ of size 1 at 0x61100000977f thread T0
    #0 0x5633b4c76a13 in rl_tilde_expand 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13)
    #1 0x5633b4c3730d in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fc30d)
    #2 0x5633b4c37aef in _rl_dispatch_subseq 
(/home/dualbus/src/gnu/bash-build/bash+0x1fcaef)
    #3 0x5633b4c36ee8 in _rl_dispatch 
(/home/dualbus/src/gnu/bash-build/bash+0x1fbee8)
    #4 0x5633b4c36727 in readline_internal_char 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb727)
    #5 0x5633b4c367b9 in readline_internal_charloop 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7b9)
    #6 0x5633b4c367dd in readline_internal 
(/home/dualbus/src/gnu/bash-build/bash+0x1fb7dd)
    #7 0x5633b4c35e93 in readline 
(/home/dualbus/src/gnu/bash-build/bash+0x1fae93)
    #8 0x5633b4bf1136 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6136)
    #9 0x5633b4beeaa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #10 0x5633b4b04c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #11 0x5633b4b0689f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #12 0x5633b4b0411f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #13 0x5633b4af1f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #14 0x5633b4afa82e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #15 0x5633b4af2d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #16 0x5633b4bdc0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #17 0x5633b4abd401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #18 0x5633b4abb8da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #19 0x7f891c43f2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #20 0x5633b4aba749 in _start (/home/dualbus/src/gnu/bash-build/bash+0x7f749)
0x61100000977f is located 1 bytes to the left of 256-byte region 
[0x611000009780,0x611000009880)
allocated by thread T0 here:
    #0 0x7f891ccacd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
    #1 0x5633b4bcad95 in xmalloc 
(/home/dualbus/src/gnu/bash-build/bash+0x18fd95)
    #2 0x5633b4c38220 in readline_initialize_everything 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd220)
    #3 0x5633b4c380c6 in rl_initialize 
(/home/dualbus/src/gnu/bash-build/bash+0x1fd0c6)
    #4 0x5633b4ba5c28 in initialize_readline 
(/home/dualbus/src/gnu/bash-build/bash+0x16ac28)
    #5 0x5633b4bf1096 in edit_line 
(/home/dualbus/src/gnu/bash-build/bash+0x1b6096)
    #6 0x5633b4beeaa4 in read_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0x1b3aa4)
    #7 0x5633b4b04c89 in execute_builtin 
(/home/dualbus/src/gnu/bash-build/bash+0xc9c89)
    #8 0x5633b4b0689f in execute_builtin_or_function 
(/home/dualbus/src/gnu/bash-build/bash+0xcb89f)
    #9 0x5633b4b0411f in execute_simple_command 
(/home/dualbus/src/gnu/bash-build/bash+0xc911f)
    #10 0x5633b4af1f42 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb6f42)
    #11 0x5633b4afa82e in execute_connection 
(/home/dualbus/src/gnu/bash-build/bash+0xbf82e)
    #12 0x5633b4af2d17 in execute_command_internal 
(/home/dualbus/src/gnu/bash-build/bash+0xb7d17)
    #13 0x5633b4bdc0f4 in parse_and_execute 
(/home/dualbus/src/gnu/bash-build/bash+0x1a10f4)
    #14 0x5633b4abd401 in run_one_command 
(/home/dualbus/src/gnu/bash-build/bash+0x82401)
    #15 0x5633b4abb8da in main (/home/dualbus/src/gnu/bash-build/bash+0x808da)
    #16 0x7f891c43f2b0 in __libc_start_main 
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow 
(/home/dualbus/src/gnu/bash-build/bash+0x23ba13) in rl_tilde_expand
Shadow bytes around the buggy address:
  0x0c227fff9290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c227fff92c0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff92d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff92e0: 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
  0x0c227fff92f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9310: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c227fff9320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c227fff9330: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3340==ABORTING

INPUT
KHo0jwAIAQEB/wsLYJgAABsbGyYA2AgiGxsbALwksygoKCgoAAAAECgoKB0eHoB/iU3pABAolGCA
//0H+lwaGhjYCCIbGxsAvCSzKCgoKCgEAAAQKCgoHR4egH+JTekAEosSAEAAAAAZAAAAQDw7AAKA
HhYKGgAQAAL/gFv/AP8eHh4BJiYmJiYmJiYmJiYmMx4ZPIM8APypaOYCAI6kPBlW0Un///8A/2AE
Wx4EBEAAAyBaPQh/OHwQIBAABAAQAAIA//8AADw9C0AhGf5/AI6OozwLLz0LQFVA+RsAoAAABDwZ
GRkZGRkZGRkuGRkZGRkAQwD8jjwZEAA8/yokUo6k+xlW0QAcyARAAAMVGVY8KCooKCgoKCgoKCgo
KCgoKCgoHR4eHhgxnGA8Iz0L3d3d3d3d3d3d3d3d8t3d3d3d3d3d3d3d3d3d3d3dIAABfQQyY/wZ
ENobBQ==

-- 
Eduardo Bustamante
https://dualbus.me/
reply via email to
[Prev in Thread] Current Thread [Next in Thread]