[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v3 12/18] crypto: fix stack-buffer-overflow erro
From: |
Thomas Huth |
Subject: |
Re: [Qemu-devel] [PATCH v3 12/18] crypto: fix stack-buffer-overflow error |
Date: |
Thu, 4 Jan 2018 17:40:36 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 |
On 04.01.2018 17:05, Marc-André Lureau wrote:
> ASAN complains about:
>
> ==8856==ERROR: AddressSanitizer: stack-buffer-overflow on address
> 0x7ffd8a1fe168 at pc 0x561136cb4451 bp 0x7ffd8a1fe130 sp 0x7ffd8a1fd8e0
> READ of size 16 at 0x7ffd8a1fe168 thread T0
> #0 0x561136cb4450 in __asan_memcpy
> (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450)
> #1 0x561136d2a6a7 in qcrypto_ivgen_essiv_calculate
> /home/elmarco/src/qq/crypto/ivgen-essiv.c:83:5
> #2 0x561136d29af8 in qcrypto_ivgen_calculate
> /home/elmarco/src/qq/crypto/ivgen.c:72:12
> #3 0x561136d07c8e in test_ivgen
> /home/elmarco/src/qq/tests/test-crypto-ivgen.c:148:5
> #4 0x7f77772c3b04 in test_case_run
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2237
> #5 0x7f77772c3ec4 in g_test_run_suite_internal
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2321
> #6 0x7f77772c3f6d in g_test_run_suite_internal
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
> #7 0x7f77772c3f6d in g_test_run_suite_internal
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
> #8 0x7f77772c3f6d in g_test_run_suite_internal
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2333
> #9 0x7f77772c4184 in g_test_run_suite
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:2408
> #10 0x7f77772c2e0d in g_test_run
> /home/elmarco/src/gnome/glib/builddir/../glib/gtestutils.c:1674
> #11 0x561136d0799b in main
> /home/elmarco/src/qq/tests/test-crypto-ivgen.c:173:12
> #12 0x7f77756e6039 in __libc_start_main (/lib64/libc.so.6+0x21039)
> #13 0x561136c13d89 in _start
> (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x6fd89)
>
> Address 0x7ffd8a1fe168 is located in stack of thread T0 at offset 40 in frame
> #0 0x561136d2a40f in qcrypto_ivgen_essiv_calculate
> /home/elmarco/src/qq/crypto/ivgen-essiv.c:76
>
> This frame has 1 object(s):
> [32, 40) 'sector.addr' <== Memory access at offset 40 overflows this
> variable
> HINT: this may be a false positive if your program uses some custom stack
> unwind mechanism or swapcontext
> (longjmp and C++ exceptions *are* supported)
> SUMMARY: AddressSanitizer: stack-buffer-overflow
> (/home/elmarco/src/qq/build/tests/test-crypto-ivgen+0x110450) in __asan_memcpy
> Shadow bytes around the buggy address:
> 0x100031437bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> =>0x100031437c20: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00[f3]f3 f3
> 0x100031437c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 0x100031437c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Shadow byte legend (one shadow byte represents 8 application bytes):
> Addressable: 00
> Partially addressable: 01 02 03 04 05 06 07
> Heap left redzone: fa
> Freed heap region: fd
> Stack left redzone: f1
> Stack mid redzone: f2
> Stack right redzone: f3
> Stack after return: f5
> Stack use after scope: f8
> Global redzone: f9
> Global init order: f6
> Poisoned by user: f7
> Container overflow: fc
> Array cookie: ac
> Intra object redzone: bb
> ASan internal: fe
> Left alloca redzone: ca
> Right alloca redzone: cb
>
> It looks like the rest of the code copes with ndata being larger than
> sizeof(sector), so limit the memcpy() range.
>
> Signed-off-by: Marc-André Lureau <address@hidden>
> Reviewed-by: Daniel P. Berrange <address@hidden>
> ---
> crypto/ivgen-essiv.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/crypto/ivgen-essiv.c b/crypto/ivgen-essiv.c
> index cba20bde6c..ad4d926c19 100644
> --- a/crypto/ivgen-essiv.c
> +++ b/crypto/ivgen-essiv.c
> @@ -79,7 +79,7 @@ static int qcrypto_ivgen_essiv_calculate(QCryptoIVGen
> *ivgen,
> uint8_t *data = g_new(uint8_t, ndata);
>
> sector = cpu_to_le64(sector);
> - memcpy(data, (uint8_t *)§or, ndata);
> + memcpy(data, (uint8_t *)§or, MIN(sizeof(sector), ndata));
> if (sizeof(sector) < ndata) {
> memset(data + sizeof(sector), 0, ndata - sizeof(sector));
> }
>
Ah, funny, completely unaware of your patch series, I accidentally came
to the same conclusion two days ago:
https://lists.gnu.org/archive/html/qemu-devel/2018-01/msg00062.html
So if you like, feel free to add:
Reviewed-by: Thomas Huth <address@hidden>
Tested-by: Thomas Huth <address@hidden>
- [Qemu-devel] [PATCH v3 06/18] tests/docker: add test-debug, (continued)
- [Qemu-devel] [PATCH v3 06/18] tests/docker: add test-debug, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 07/18] build-sys: add some sanitizers when --enable-debug if possible, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 08/18] tests: fix check-qobject leak, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 09/18] vl: fix direct firmware directories leak, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 10/18] readline: add a free function, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 11/18] tests: fix migration-test leak, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 12/18] crypto: fix stack-buffer-overflow error, Marc-André Lureau, 2018/01/04
- Re: [Qemu-devel] [PATCH v3 12/18] crypto: fix stack-buffer-overflow error,
Thomas Huth <=
- [Qemu-devel] [PATCH v3 13/18] qemu-config: fix leak in query-command-line-options, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 14/18] tests: fix qmp-test leak, Marc-André Lureau, 2018/01/04
- [Qemu-devel] [PATCH v3 15/18] ucontext: annotate coroutine stack for ASAN, Marc-André Lureau, 2018/01/04
[Qemu-devel] [PATCH v3 17/18] mips: fix potential fopen(NULL,...), Marc-André Lureau, 2018/01/04