HEAP BUFFER OVERFLOW BUG

[abhishek singh]

### Description
heap-buffer-overflow indent/src/output.c:319 in set_buf_break.
CVE-2023-40305 has heap-buffer-overflow in search_brace, but this bug is in
set_buf_break in indent/src/output.c
POC file is attached

### GNU indent Version
```
GNU indent 2.2.13
```
### Steps to recreate
```
cd indent
autoreconf -i
./configure --disable-nls
make
indent ./poc
```
### POC
[poc](https://paste.debian.net/download/1304713)
### Crash Info
```
-> indent/src/indent
id:000012,sig:06,src:000003,time:58344633,execs:1235790,op:arith8,pos:7267,val:+30
/home/output
=================================================================
==1429449==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x6020000003ec at pc 0x55d7c332e0d1 bp 0x7ffc002e4940 sp 0x7ffc002e4938
READ of size 2 at 0x6020000003ec thread T0
    #0 0x55d7c332e0d0 in set_buf_break
/home/nu1lptr/afl/indent/src/output.c:319:13
    #1 0x55d7c33047c7 in indent_main_loop
/home/nu1lptr/afl/indent/src/indent.c:640:17
    #2 0x55d7c33047c7 in indent /home/nu1lptr/afl/indent/src/indent.c:759:12
    #3 0x55d7c32ff361 in indent_multiple_files
/home/nu1lptr/afl/indent/src/indent.c:938:18
    #4 0x55d7c32ff361 in indent_all
/home/nu1lptr/afl/indent/src/indent.c:1036:23
    #5 0x55d7c32ff361 in main /home/nu1lptr/afl/indent/src/indent.c:1123:23
    #6 0x7fb444e29d8f in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #7 0x7fb444e29e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #8 0x55d7c3225324 in _start
(/home/nu1lptr/afl/indent/src/indent+0x6a324) (BuildId: bf919c9b1b6dfa4b)

0x6020000003ec is located 4 bytes before 16-byte region
[0x6020000003f0,0x602000000400)
allocated by thread T0 here:
    #0 0x55d7c32bf338 in calloc
(/home/nu1lptr/afl/indent/src/indent+0x104338) (BuildId: bf919c9b1b6dfa4b)
    #1 0x55d7c332912c in xmalloc /home/nu1lptr/afl/indent/src/globs.c:42:17
    #2 0x55d7c3304904 in indent_main_loop
/home/nu1lptr/afl/indent/src/indent.c:672:9
    #3 0x55d7c3304904 in indent /home/nu1lptr/afl/indent/src/indent.c:759:12
    #4 0x55d7c32ff361 in indent_multiple_files
/home/nu1lptr/afl/indent/src/indent.c:938:18
    #5 0x55d7c32ff361 in indent_all
/home/nu1lptr/afl/indent/src/indent.c:1036:23
    #6 0x55d7c32ff361 in main /home/nu1lptr/afl/indent/src/indent.c:1123:23
    #7 0x7fb444e29d8f in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow
/home/nu1lptr/afl/indent/src/output.c:319:13 in set_buf_break
Shadow bytes around the buggy address:
  0x602000000100: fa fa 06 fa fa fa 06 fa fa fa 06 fa fa fa 06 fa
  0x602000000180: fa fa 06 fa fa fa 06 fa fa fa 07 fa fa fa 07 fa
  0x602000000200: fa fa 00 fa fa fa 00 02 fa fa fd fa fa fa fd fa
  0x602000000280: fa fa fd fa fa fa fd fd fa fa 00 fa fa fa fd fa
  0x602000000300: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fd
=>0x602000000380: fa fa fd fd fa fa fd fd fa fa fd fd fa[fa]00 00
  0x602000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x602000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x602000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x602000000580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x602000000600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1429449==ABORTING
```

### System Info
Linux ip-10-0-1-50 6.2.0-1013-aws #13~22.04.1-Ubuntu SMP Fri Sep  8
17:29:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0

### CREDIT
[INFOSECIITR](https://infoseciitr.in)