antirez / antirez/kilo

Heap buffer overflow in kilo's editor_update_syntax(…)

Abierto
#36 7 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
C
Estrellas
9.1k
Forks
995
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

Hi,

Kilo appears to have a heap buffer overflow triggered by the `memcmp` call [on line 475 of kilo.c](https://github.com/antirez/kilo/blob/master/kilo.c#L475):

```
int j;
for (j = 0; keywords[j]; j++) {
int klen = strlen(keywords[j]);
int kw2 = keywords[j][klen-1] == '|';
if (kw2) klen--;

if (!memcmp(p,keywords[j],klen) &&
```

The signature of `memcmp`:

```
int memcmp(const void *s1, const void *s2, size_t n);
```

`memcmp` operates under the assumption that `s1` and `s2` are at least `n` bytes long each.

This assumption clearly holds for the second argument (`keywords[j]`), but there are no checks in place that makes sure that this assumption holds also for the first argument (`p`).

The heap overflow can be verified by compiling `kilo` with ASAN enabled:

```
$ git clone https://github.com/antirez/kilo.git
$ cd kilo
$ clang -fsanitize=address -o kilo kilo.c
$ ./kilo kilo.c
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000dcd5 at pc 0x0001029f16f9 bp 0x7fff5d233440 sp 0x7fff5d232c00
READ of size 6 at 0x60300000dcd5 thread T0
#0 0x1029f16f8 in wrap_memcmp (libclang_rt.asan_osx_dynamic.dylib+0x116f8)
#1 0x1029d08db in editorUpdateSyntax (kilo+0x1000048db)
#2 0x1029d18fb in editorUpdateRow (kilo+0x1000058fb)
#3 0x1029d1d86 in editorInsertRow (kilo+0x100005d86)
#4 0x1029d3c85 in editorOpen (kilo+0x100007c85)
#5 0x1029d6ae7 in main (kilo+0x10000aae7)
#6 0x7fff8956c5ac in start (libdyld.dylib+0x35ac)
#7 0x1 ()

0x60300000dcd5 is located 0 bytes to the right of 21-byte region [0x60300000dcc0,0x60300000dcd5)
allocated by thread T0 here:
#0 0x102a289c0 in wrap_malloc (libclang_rt.asan_osx_dynamic.dylib+0x489c0)
#1 0x1029d1303 in editorUpdateRow (kilo+0x100005303)
#2 0x1029d1d86 in editorInsertRow (kilo+0x100005d86)
#3 0x1029d3c85 in editorOpen (kilo+0x100007c85)
#4 0x1029d6ae7 in main (kilo+0x10000aae7)
#5 0x7fff8956c5ac in start (libdyld.dylib+0x35ac)
#6 0x1 ()
```

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.