citusdata / citusdata/postgresql-hll
Out-Of-Bound (OOB) Read Memory Issue in hll.c
- Dominant language
- C
- Stars
- 1.2k
- Forks
- 115
- PR merge metrics
- No merged PRs in 30d
Description
## Overview
While fuzzing `hll` using AFL++ and AddressSanitizer, I discovered that there is an Out-Of-Bound (OOB) reading memory issue in hll.c. This may lead to data leakage.
## Environment
OS: Ubuntu 22.04.5 LTS (x64)
PostgreSQL: 18.0 (./configure --enable-cassert --enable-debug CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g -O1 -fsanitize-recover=address" LDFLAGS="-fsanitize=address" CC=gcc-11 CXX=g++-11), also replicable when compiled with GCC 13.3.0
Extension hll: 0bdacc2d0e8d969a47521d1c5f6e1927ac0d01c6 (the new commits didn't change the hll.c file)
Extension compilation: CC=afl-clang-fast COPT=-g -O2 -fgnu89-inline -fgnu89-inline -fsanitize=address -fno-omit-frame-pointer (also replicable when compiled with GCC 13.3.0)
AFL++ version: https://github.com/aflplusplus/aflplusplus bf2eac470804df48a1bca6a78d4dd6c71968a556
PostgreSQL setup:
- compile, install
- initdb -D xxx
- install the extension
- createdb `test`
- create extension hll (on the `test` database)
- fuzzing started, feed sqls
- e.g., SELECT public.hll_union_agg(public.hll_in('',(select oid from pg_proc order by random() limit 1),-1656396078));
- ...
## Affected Code
src/hll.c#1394
```C
1387 static uint8_t
1388 multiset_unpack(multiset_t * o_msp,
1389 uint8_t const * i_bitp,
1390 size_t i_size,
1391 uint8_t * o_encoded_type)
1392 {
1393 // First byte is the version and type header.
1394 uint8_t vers = (i_bitp[0] >> 4) & 0xf;
```
## Possible SQLs that Trigger the Problem
```sql
SELECT public.hll_send(public.hll_in('',(select oid from pg_type order by random() limit 1),-2009041878));
SELECT public.hll_regwidth(public.hll_in('',(select oid from pg_amop order by random() limit 1),-407359608));
SELECT public.hll_send(public.hll_in('',(select oid from pg_type order by random() limit 1),-868791912));
SELECT public.hll_union_agg(public.hll_in('',(select oid from pg_am order by random() limit 1),-525017700));
SELECT public.hll_add(public.hll_in('',(select oid from pg_language order by random() limit 1),-624541417),public.hll_hash_text('}s<%>',432407345));
SELECT public.hll_add_rev(public.hll_hashval_in('0x0a4a80003940:[04]f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0a4a80003950: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0a4a80003960: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0a4a80003970: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0a4a80003980: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
0x0a4a80003990: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
```
## Expanded C source file
A preprocessed and macro-expanded version of the code can be found https://github.com/gaoxiangliu/fuzzing-dbms-extensions-logs/blob/main/postgresql/hll/0bdaccpg18/hll.c
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.