You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
To see this chmlib needs to be run with valgrind or compiled with address sanitizer. When address sanitizer is not used it will cause an infinite loop.
Found with the help of american fuzzy lop.
Address Sanitizer output:
==6074==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001c900 at pc 0x0000004e2d26 bp 0x7ffff01a3eb0 sp 0x7ffff01a3ea8
READ of size 1 at 0x62100001c900 thread T0
#0 0x4e2d25 in _chm_skip_cword /f/chmlib-0.40/src/chm_lib.c:1096:12 #1 0x4e2d25 in _chm_skip_PMGL_entry_data /f/chmlib-0.40/src/chm_lib.c:1104 #2 0x4e2d25 in _chm_find_in_PMGL /f/chmlib-0.40/src/chm_lib.c:1200 #3 0x4e2d25 in chm_resolve_object /f/chmlib-0.40/src/chm_lib.c:1287 #4 0x4de582 in chm_open /f/chmlib-0.40/src/chm_lib.c:901:32 #5 0x4dcc0b in main /f/chmlib-0.40/src/enum_chmLib.c:69:13 #6 0x7f3694114f9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289 #7 0x4363d6 in _start (/mnt/ram/chmlib/enum_chmLib+0x4363d6)
0x62100001c900 is located 0 bytes to the right of 4096-byte region [0x62100001b900,0x62100001c900)
allocated by thread T0 here:
#0 0x4bd3a2 in __interceptor_malloc (/mnt/ram/chmlib/enum_chmLib+0x4bd3a2) #1 0x4e0ab3 in chm_resolve_object /f/chmlib-0.40/src/chm_lib.c:1263:23 #2 0x4de582 in chm_open /f/chmlib-0.40/src/chm_lib.c:901:32 #3 0x4dcc0b in main /f/chmlib-0.40/src/enum_chmLib.c:69:13
SUMMARY: AddressSanitizer: heap-buffer-overflow /f/chmlib-0.40/src/chm_lib.c:1096 _chm_skip_cword
Shadow bytes around the buggy address:
0x0c427fffb8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffb920:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6074==ABORTING
The text was updated successfully, but these errors were encountered:
This file will trigger a heap overflow in chmlib (test with enum_chmLib):
https://crashes.fuzzing-project.org/chmlib-heapoverflow-_chm_skip_cword.chm
To see this chmlib needs to be run with valgrind or compiled with address sanitizer. When address sanitizer is not used it will cause an infinite loop.
Found with the help of american fuzzy lop.
Address Sanitizer output:
==6074==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001c900 at pc 0x0000004e2d26 bp 0x7ffff01a3eb0 sp 0x7ffff01a3ea8
READ of size 1 at 0x62100001c900 thread T0
#0 0x4e2d25 in _chm_skip_cword /f/chmlib-0.40/src/chm_lib.c:1096:12
#1 0x4e2d25 in _chm_skip_PMGL_entry_data /f/chmlib-0.40/src/chm_lib.c:1104
#2 0x4e2d25 in _chm_find_in_PMGL /f/chmlib-0.40/src/chm_lib.c:1200
#3 0x4e2d25 in chm_resolve_object /f/chmlib-0.40/src/chm_lib.c:1287
#4 0x4de582 in chm_open /f/chmlib-0.40/src/chm_lib.c:901:32
#5 0x4dcc0b in main /f/chmlib-0.40/src/enum_chmLib.c:69:13
#6 0x7f3694114f9f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.20-r2/work/glibc-2.20/csu/libc-start.c:289
#7 0x4363d6 in _start (/mnt/ram/chmlib/enum_chmLib+0x4363d6)
0x62100001c900 is located 0 bytes to the right of 4096-byte region [0x62100001b900,0x62100001c900)
allocated by thread T0 here:
#0 0x4bd3a2 in __interceptor_malloc (/mnt/ram/chmlib/enum_chmLib+0x4bd3a2)
#1 0x4e0ab3 in chm_resolve_object /f/chmlib-0.40/src/chm_lib.c:1263:23
#2 0x4de582 in chm_open /f/chmlib-0.40/src/chm_lib.c:901:32
#3 0x4dcc0b in main /f/chmlib-0.40/src/enum_chmLib.c:69:13
SUMMARY: AddressSanitizer: heap-buffer-overflow /f/chmlib-0.40/src/chm_lib.c:1096 _chm_skip_cword
Shadow bytes around the buggy address:
0x0c427fffb8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c427fffb910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffb920:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb960: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c427fffb970: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==6074==ABORTING
The text was updated successfully, but these errors were encountered: