-
Notifications
You must be signed in to change notification settings - Fork 778
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
heap buffer overflow on some inputs #125
Comments
From my session of code reading and debugging I came to the conclusion that mistakes lie on both sides but example program is the one at fault. Out of bounds reads are caused by dump function assuming that each key has a value token next to it. That causes loop on line 43 to read more than it's supposed to as |
Also, that's out of bounds read and not buffer overflow. |
@pt300 Basically I just reported the error according to the sanitizer and hadn't had time to dig into root cause. I think your analysis leads to the bug fix. |
I experienced a bug which I just reported at #137 which I think might be an example of this out of bounds read. |
If you read the comments you'd realise that's not the case |
Are you sure? |
Yes, I am sure. This problem is related to the example program assuming that each key in object has a value, which isn't the case in the buggy json OP provided. In your case it's something different and I'm not sure what exactly is it yet. |
I did some analysis with AFL (well, I just compiled for AFL with ASAN enabled and waited for things to crash) and didn't have to wait for very long (actually it crashed within seconds). From the example inputs to jsondump (which I used for my tests) I gathered the following examples for crashes (one crashing input per line):
|
@BenBE if these crashes are unrelated to this issue then just create new one with more informations, otherwise what you wrote is not helping here. |
@pt300 Looking at the output of those sample inputs it seems very likely they are related. Comparing with the ASAN output @hongxuchen posted there's little doubt they aren't related. Just posted a list of minimal samples to ease reproduction of the issue. This also gives a list of other, related inputs to check when fixing the issue. Other bugs might be hidden due to this parsing issue. |
I've checked your inputs and yes they are caused by the same thing. And so fix proposed by me still prevents these crashes. I'll try to make a pull request I guess. |
Fix was added with conversion of jsmn to .h only library |
We found a heap buffer overflow bug on jsondump with our fuzzing tool FOT's semantic related functionality, with the following commands (memory leak of jsondump we think is not a big issue):
One simple test case is as follows, which is mutated based on
library.json
.The error output is:
There are other input tests that can trigger this bug with similar root cause (
*.input.txt
is the input file, and*.err.txt
is the error output).w01_000011,sig:6,Splice:3:16,src:w02_000052.err.txt
w01_000011,sig:6,Splice:3:16,src:w02_000052.input.txt
w02_000003,sig:6,Havoc:21:35,src:w01_000052.err.txt
w02_000003,sig:6,Havoc:21:35,src:w01_000052.input.txt
The text was updated successfully, but these errors were encountered: