You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This was found with american fuzzy lop and can be seen with address sanitizer.
Address sanitizer output:
==29251==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d00000ccb7 at pc 0x7f0bd3090d70 bp 0x7fff1864df00 sp 0x7fff1864ded0
READ of size 18 at 0x60d00000ccb7 thread T0
#0 0x7f0bd3090d6f in strlen (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x32d6f)
#1 0x7f0bd19f567d in r_bin_dwarf_parse_ext_opcode /f/radare2/radare2/libr/bin/dwarf.c:463
#2 0x7f0bd19f567d in r_bin_dwarf_parse_opcodes /f/radare2/radare2/libr/bin/dwarf.c:666
#3 0x7f0bd19f567d in r_bin_dwarf_parse_line_raw2 /f/radare2/radare2/libr/bin/dwarf.c:717
#4 0x7f0bd19fe346 in r_bin_dwarf_parse_line /f/radare2/radare2/libr/bin/dwarf.c:1533
#5 0x7f0bd2aa46e2 in bin_dwarf /f/radare2/radare2/libr/core/bin.c:472
#6 0x7f0bd2aa46e2 in r_core_bin_info /f/radare2/radare2/libr/core/bin.c:1656
#7 0x7f0bd2aa691d in r_core_bin_set_env /f/radare2/radare2/libr/core/bin.c:101
#8 0x7f0bd2a3db3e in r_core_file_do_load_for_io_plugin /f/radare2/radare2/libr/core/file.c:355
#9 0x7f0bd2a3db3e in r_core_bin_load /f/radare2/radare2/libr/core/file.c:487
#10 0x405a3d in main /f/radare2/radare2/binr/radare2/radare2.c:585
#11 0x7f0bccf28f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
#12 0x40a0dd (/mnt/ram/radare2/radare2+0x40a0dd)
0x60d00000ccb7 is located 0 bytes to the right of 135-byte region [0x60d00000cc30,0x60d00000ccb7)
allocated by thread T0 here:
#0 0x7f0bd30b5855 in calloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x57855)
#1 0x7f0bd19fe277 in r_bin_dwarf_parse_line /f/radare2/radare2/libr/bin/dwarf.c:1525
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strlen
Shadow bytes around the buggy address:
0x0c1a7fff9940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff9980: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
=>0x0c1a7fff9990: 00 00 00 00 00 00[07]fa fa fa fa fa fa fa fa fa
0x0c1a7fff99a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff99b0: 00 03 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x0c1a7fff99c0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
0x0c1a7fff99d0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff99e0: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==29251==ABORTING
The text was updated successfully, but these errors were encountered:
An invalid elf file can cause an out of bounds memory access in the function r_bin_dwarf_parse_ext_opcode. Example file:
https://crashes.fuzzing-project.org/radare2-oob-heap-read-r_bin_dwarf_parse_ext_opcode
This was found with american fuzzy lop and can be seen with address sanitizer.
Address sanitizer output:
The text was updated successfully, but these errors were encountered: