Recent changes to 11: Heap-based Buffer Overflow in the get_line() functionhttps://sourceforge.net/p/mcpp/bugs/11/2024-03-26T16:21:32.989000ZRecent changes to 11: Heap-based Buffer Overflow in the get_line() function#11 Heap-based Buffer Overflow in the get_line() function2024-03-26T16:21:32.989000Z2024-03-26T16:21:32.989000ZJohn Brandwoodhttps://sourceforge.net/u/jbrandwood/https://sourceforge.netd39b77b77ce226df702c65b48ac429b7714df4bb<div class="markdown_content"><p>For anyone looking at this thread currently ... this was fixed back in 2019 by the Debian maintainers with 04-gniibe-fix-12.patch</p>
<p>I have applied a slightly modified version of that patch here ...<br/>
<a href="https://github.com/jbrandwood/mcpp/commit/1d56f3287b20bb3876be1a0cc132e06dada5256b" rel="nofollow">https://github.com/jbrandwood/mcpp/commit/1d56f3287b20bb3876be1a0cc132e06dada5256b</a></p></div>#11 Heap-based Buffer Overflow in the get_line() function2019-06-19T11:01:20.235000Z2019-06-19T11:01:20.235000ZFrederic Cambushttps://sourceforge.net/u/fcambus/https://sourceforge.netbc858ca9d96be0d831626f94f70a7bb85609a896<div class="markdown_content"><p>Attached the wrong file, here is the reproducer.</p></div>Heap-based Buffer Overflow in the get_line() function2019-06-19T10:57:35.733000Z2019-06-19T10:57:35.733000ZFrederic Cambushttps://sourceforge.net/u/fcambus/https://sourceforge.net90c7411712ef64b1efe0b35d2dfdb1ba4b6c2535<div class="markdown_content"><p>Hi,</p>
<p>While fuzzing mcpp with American Fuzzy Lop, I found a Heap-based<br/>
Buffer Overflow in the get_line() function, in support.c L1957.</p>
<p>Attaching a reproducer, issue can be reproduced by running:</p>
<p>mcpp test-get_line</p>
<p>Regards,<br/>
Frederic Cambus.</p>
<p>=================================================================<br/>
==13894==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000007ff at pc 0x00000055e553 bp 0x7ffd9dfabbd0 sp 0x7ffd9dfabbc8<br/>
READ of size 1 at 0x6310000007ff thread T0<br/>
#0 0x55e552 in get_line /home/fcambus/mcpp-2.7.2/src/support.c:1957:13<br/>
#1 0x558ba2 in parse_line /home/fcambus/mcpp-2.7.2/src/support.c:1657:15<br/>
#2 0x550214 in get_ch /home/fcambus/mcpp-2.7.2/src/support.c:1580:13<br/>
#3 0x513c1b in mcpp_main /home/fcambus/mcpp-2.7.2/src/main.c:626:17<br/>
#4 0x513396 in main /home/fcambus/mcpp-2.7.2/src/main.c:421:5<br/>
#5 0x7fee45cfdb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310<br/>
#6 0x41a149 in _start (/home/fcambus/tmp-mcpp/mcpp+0x41a149)</p>
<p>0x6310000007ff is located 1 bytes to the left of 65536-byte region [0x631000000800,0x631000010800)<br/>
allocated by thread T0 here:<br/>
#0 0x4da000 in malloc (/home/fcambus/tmp-mcpp/mcpp+0x4da000)<br/>
#1 0x556ae4 in xmalloc /home/fcambus/mcpp-2.7.2/src/support.c:2336:28<br/>
#2 0x55b52b in get_file /home/fcambus/mcpp-2.7.2/src/support.c:2281:20<br/>
#3 0x56bb31 in add_file /home/fcambus/mcpp-2.7.2/src/system.c:3540:12<br/>
#4 0x51318a in main /home/fcambus/mcpp-2.7.2/src/main.c:412:5<br/>
#5 0x7fee45cfdb96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310</p>
<p>SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fcambus/mcpp-2.7.2/src/support.c:1957:13 in get_line<br/>
Shadow bytes around the buggy address:<br/>
0x0c627fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br/>
0x0c627fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br/>
0x0c627fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br/>
0x0c627fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br/>
0x0c627fff80e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<br/>
=>0x0c627fff80f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa<span>[fa]</span><br/>
0x0c627fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br/>
0x0c627fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br/>
0x0c627fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br/>
0x0c627fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br/>
0x0c627fff8140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00<br/>
Shadow byte legend (one shadow byte represents 8 application bytes):<br/>
Addressable: 00<br/>
Partially addressable: 01 02 03 04 05 06 07 <br/>
Heap left redzone: fa<br/>
Freed heap region: fd<br/>
Stack left redzone: f1<br/>
Stack mid redzone: f2<br/>
Stack right redzone: f3<br/>
Stack after return: f5<br/>
Stack use after scope: f8<br/>
Global redzone: f9<br/>
Global init order: f6<br/>
Poisoned by user: f7<br/>
Container overflow: fc<br/>
Array cookie: ac<br/>
Intra object redzone: bb<br/>
ASan internal: fe<br/>
Left alloca redzone: ca<br/>
Right alloca redzone: cb<br/>
==13894==ABORTING</p></div>