segfault in fwrite_crc() with malformed input

• Reporter: hanno
• 소유자: arai
• Type: Bugs
• Status: Closed
• Component: (None)
• MileStone: (None)
• Priority: 5 - Medium
• Severity: 5 - Medium
• Resolution: None
• File: None

Details Reply

This input file https://crashes.fuzzing-project.org/lha-segfault-fwrite_crc.lha causes a segfault in lha with the p parameter.

Test: lha p lha-segfault-fwrite_crc.lha

Found with american fuzzy lop and affects the current code from github.

This is the stack trace from address sanitizer:

==15954==ERROR: AddressSanitizer: SEGV on unknown address 0x7f6b33f70000 (pc 0x7f6b33c4b51b bp 0x000000002000 sp 0x7ffd66f70510 T0)
==15954==The signal is caused by a READ memory access.
    #0 0x7f6b33c4b51a in fwrite /var/tmp/portage/sys-libs/glibc-2.23-r2/work/glibc-2.23/libio/iofwrite.c:35
    #1 0x4f69fd in fwrite_crc /f/lha/lha/src/crcio.c:87:17
    #2 0x53d63f in decode /f/lha/lha/src/slide.c:451:17
    #3 0x4faf2f in decode_lzhuf /f/lha/lha/src/extract.c:97:15
    #4 0x52d929 in extract_one /f/lha/lha/src/lhext.c:386:19
    #5 0x52d929 in cmd_extract /f/lha/lha/src/lhext.c:574
    #6 0x524456 in main /f/lha/lha/src/lharc.c:680:9
    #7 0x7f6b33c0578f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.23-r2/work/glibc-2.23/csu/../csu/libc-start.c:289
    #8 0x419888 in _start (/mnt/ram/lha/lha+0x419888)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/sys-libs/glibc-2.23-r2/work/glibc-2.23/libio/iofwrite.c:35 in fwrite
==15954==ABORTING

Ticket History (3/4 Histories)

2016-05-03 22:45 Updated by: hanno

• New Ticket "segfault in fwrite_crc() with malformed input" created

2016-05-04 06:35 Updated by: arai

• 소유자 Update from (None) to arai

2016-05-04 12:05 Updated by: arai

댓글 올리기 Reply

Hmm, I can't understand why this is happened. Does it mean stdout can't handle 64 bit offset ?

2016-05-08 09:34 Updated by: arai

• Status Update from Open to Closed
• Ticket Close date is changed to 2016-05-08 09:34

댓글 올리기 Reply

Changed at 0f89645 to avoid this error, but I can't understand why this is happened.