avast / avast/retdec

Heap-buffer-overflow in retdec-fileinfo at elfio_symbols.hpp:249

Open
#1,008 0 comments 0 reactions 0 assignees View on GitHub
bug C-fileinfo
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Hello,

We are currently working on fuzz testing feature, and we found a crash on `retdec-fileinfo`.

The stack traces are as follow:
```st
==622==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000013440 at pc 0x56264f24eb37 bp 0x7ffe841966e0 sp 0x7ffe841966d0
READ of size 8 at 0x606000013440 thread T0
#0 0x56264f24eb36 in bool ELFIO::symbol_section_accessor::generic_get_symbol(unsigned long, std::__cxx11::basic_string, std::allocator >&, unsigned long&, unsigned long&, unsigned char&, unsigned char&, unsigned short&, unsigned char&) const .../retdec-git/deps/elfio/include/elfio/elfio_symbols.hpp:249
#1 0x56264f24eb36 in ELFIO::symbol_section_accessor::get_symbol(unsigned long, std::__cxx11::basic_string, std::allocator >&, unsigned long&, unsigned long&, unsigned char&, unsigned char&, unsigned short&, unsigned char&) const .../retdec-git/deps/elfio/include/elfio/elfio_symbols.hpp:82
#2 0x56264f7a93a3 in retdec::fileformat::ElfFormat::loadSymbols(ELFIO::elfio const*, ELFIO::symbol_section_accessor const*, ELFIO::section const*) .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1750
#3 0x56264f7b114f in retdec::fileformat::ElfFormat::loadSections() .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:2053
#4 0x56264f7b3487 in retdec::fileformat::ElfFormat::initStructures() .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1131
#5 0x56264f7b3d4b in retdec::fileformat::ElfFormat::ElfFormat(std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags) .../retdec-git/src/fileformat/file_format/elf/elf_format.cpp:1093
#6 0x56264f4acb1a in retdec::fileinfo::ElfWrapper::ElfWrapper(std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_wrapper/elf_wrapper.cpp:19
#7 0x56264f23fc26 in void __gnu_cxx::new_allocator::construct, std::allocator >, retdec::fileformat::LoadFlags&>(retdec::fileinfo::ElfWrapper*, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/ext/new_allocator.h:136
#8 0x56264f23fc26 in void std::allocator_traits >::construct, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator&, retdec::fileinfo::ElfWrapper*, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/alloc_traits.h:475
#9 0x56264f23fc26 in std::_Sp_counted_ptr_inplace, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:526
#10 0x56264f23fc26 in std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, retdec::fileinfo::ElfWrapper*, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:637
#11 0x56264f23fc26 in std::__shared_ptr::__shared_ptr, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr_base.h:1295
#12 0x56264f23fc26 in std::shared_ptr::shared_ptr, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::_Sp_make_shared_tag, std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:344
#13 0x56264f23fc26 in std::shared_ptr std::allocate_shared, std::__cxx11::basic_string, std::allocator >, retdec::fileformat::LoadFlags&>(std::allocator const&, std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:691
#14 0x56264f23fc26 in std::shared_ptr std::make_shared, std::allocator >, retdec::fileformat::LoadFlags&>(std::__cxx11::basic_string, std::allocator >&&, retdec::fileformat::LoadFlags&) /usr/include/c++/7/bits/shared_ptr.h:707
#15 0x56264f23fc26 in retdec::fileinfo::ElfDetector::ElfDetector(std::__cxx11::basic_string, std::allocator >, retdec::fileinfo::FileInformation&, retdec::cpdetect::DetectParams&, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_detector/elf_detector.cpp:782
#16 0x56264f22b42f in retdec::fileinfo::createFileDetector(std::__cxx11::basic_string, std::allocator > const&, std::__cxx11::basic_string, std::allocator > const&, retdec::fileformat::Format, retdec::fileinfo::FileInformation&, retdec::cpdetect::DetectParams&, retdec::fileformat::LoadFlags) .../retdec-git/src/fileinfo/file_detector/detector_factory.cpp:48
#17 0x56264f196482 in main .../retdec-git/src/fileinfo/fileinfo.cpp:788
```
Here is the full stack trace :
[stacktrace_retdec-fileinfo_1.zip](https://github.com/avast/retdec/files/7078367/stacktrace_retdec-fileinfo_1.zip)

**Step to reproduce**

We configured `retdec-fileinfo` using `CFLAGS="-g -O0 -fsanitize=address" CXXFLAGS="-g -O0 -fsanitize=address" cmake -DBUILD_SHARED_LIBS=OFF -DRETDEC_ENABLE_ALL=OFF -DRETDEC_ENABLE_FILEINFO=ON .. ` and built it using `make -j10; make install`, and run it with:

```
./retdec-fileinfo
```
Attachment:
[input_retdec-fileinfo_1.zip](https://github.com/avast/retdec/files/7078368/input_retdec-fileinfo_1.zip)

**Environment**
- OS: Ubuntu 18.04.5 LTS
- GCC version: gcc 7.5.0
- retdec version: latest commit of master branch on github ([link](https://github.com/avast/retdec/tree/e364c52dd07cf30d3e13820e84f3e11052ae4c03))

Thank you.

Contributor guide

No contributing guide indexed for this repository

Research direction

Build retdec-fileinfo with the shown AddressSanitizer flags and run it on input_retdec-fileinfo_1.zip. Start at deps/elfio/include/elfio/elfio_symbols.hpp:249 and follow the call into src/fileformat/file_format/elf/elf_format.cpp:1750. Done means the attached input no longer produces a heap-buffer-overflow under ASan, with regression coverage if the existing tests provide an appropriate entry point.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.