Page MenuHome GnuPG
Create Task
Maniphest T7662

GPG's uncompress_ecc_q_in_canon_sexp reads past a constant string into rodata
Closed, ResolvedPublic
Actions

Description

When running make check with -fsanitize=address you can see the following test fails:

PASS: t-sysutils
=================================================================
==312532==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000043f88b at pc 0x7fde1fcacab7 bp 0x7ffc5bcdf1e0 sp 0x7ffc5bcde9a0
READ of size 20 at 0x00000043f88b thread T0
    #0 0x7fde1fcacab6 in MemcmpInterceptorCommon(void*, int (*)(void const*, void const*, unsigned long), void const*, void const*, unsigned long) (/lib64/libasan.so.8+0xacab6) (BuildId: 6a82bb83b1f19d3f3a2118085acf79daa3b52371)
    #1 0x7fde1fcacf51 in memcmp (/lib64/libasan.so.8+0xacf51) (BuildId: 6a82bb83b1f19d3f3a2118085acf79daa3b52371)
    #2 0x00000040b0e0 in uncompress_ecc_q_in_canon_sexp (/home/collin/.local/src/gnupg/common/t-sexputil+0x40b0e0) (BuildId: f25bb836ad79cded5a81c271aff549890b058a13)
    #3 0x00000040551d in test_ecc_uncompress (/home/collin/.local/src/gnupg/common/t-sexputil+0x40551d) (BuildId: f25bb836ad79cded5a81c271aff549890b058a13)
    #4 0x000000402e81 in main (/home/collin/.local/src/gnupg/common/t-sexputil+0x402e81) (BuildId: f25bb836ad79cded5a81c271aff549890b058a13)
    #5 0x7fde1f2115f4 in __libc_start_call_main (/lib64/libc.so.6+0x35f4) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
    #6 0x7fde1f2116a7 in __libc_start_main@@GLIBC_2.34 (/lib64/libc.so.6+0x36a7) (BuildId: 2b3c02fe7e4d3811767175b6f323692a10a4e116)
    #7 0x000000403584 in _start (/home/collin/.local/src/gnupg/common/t-sexputil+0x403584) (BuildId: f25bb836ad79cded5a81c271aff549890b058a13)

0x00000043f88b is located 0 bytes after global variable '*.LC26' defined in 'sexputil.c' (0x00000043f880) of size 11
  '*.LC26' is ascii string 'public-key'
0x00000043f88b is located 53 bytes before global variable '*.LC27' defined in 'sexputil.c' (0x00000043f8c0) of size 12
  '*.LC27' is ascii string 'private-key'
SUMMARY: AddressSanitizer: global-buffer-overflow (/home/collin/.local/src/gnupg/common/t-sexputil+0x40b0e0) (BuildId: f25bb836ad79cded5a81c271aff549890b058a13) in uncompress_ecc_q_in_canon_sexp
Shadow bytes around the buggy address:
  0x00000043f600: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 04 f9 f9 f9
  0x00000043f680: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x00000043f700: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 00 00
  0x00000043f780: 00 f9 f9 f9 f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9
  0x00000043f800: 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
=>0x00000043f880: 00[03]f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9
  0x00000043f900: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x00000043f980: 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x00000043fa00: 00 00 05 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
  0x00000043fa80: 04 f9 f9 f9 f9 f9 f9 f9 00 00 04 f9 f9 f9 f9 f9
  0x00000043fb00: 06 f9 f9 f9 f9 f9 f9 f9 06 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==312532==ABORTING
FAIL: t-sexputil

This seems to have been caused by a typo, || was used where && makes more sense. I'll send a patch with the fix.

Revisions and Commits

rG GnuPG
rGf3dfbe3fcdc0 common: Fix read buffer over-read in uncompress_ecc_q_in_canon_sexp.
rG01cb3ba62d77 common: Fix read buffer over-read in uncompress_ecc_q_in_canon_sexp.
rG57c1c96e7f5c common: Fix read buffer over-read in uncompress_ecc_q_in_canon_sexp.

Related Objects