| 2020-01-10 09:23:33 |
Binbin Li |
description |
lbb@lbb:/matio-1.5.17/build$ ./bin/matdump poc_m00
InflateRankDims: inflate returned data error
=================================================================
==21267==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffff3b36320 at pc 0x7f31a19c7187 bp 0x7ffff3b357f0 sp 0x7ffff3b357e8
READ of size 4 at 0x7ffff3b36320 thread T0
#0 0x7f31a19c7186 in Mat_VarReadNextInfo5 /matio-1.5.17/src/mat5.c:4856:47
#1 0x7f31a1a22911 in Mat_VarReadNextInfo /matio-1.5.17/src/mat.c:2311:22
#2 0x4dd9b3 in main /matio-1.5.17/tools/matdump.c:942:31
#3 0x7f31a059f82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x435a28 in _start (/matio-1.5.17/build/bin/matdump+0x435a28)
Address 0x7ffff3b36320 is located in stack of thread T0 at offset 288 in frame
#0 0x7f31a19c4a5f in Mat_VarReadNextInfo5 /matio-1.5.17/src/mat5.c:4753
This frame has 22 object(s):
[32, 40) ''
[64, 72) ''
[96, 100) 'err'
[112, 116) 'data_type'
[128, 132) 'nBytes'
[144, 152) 'fpos'
[176, 184) 'matvar'
[208, 212) 'array_flags'
[224, 288) 'uncomp_buf' <== Memory access at offset 288 overflows this variable
[320, 324) 'nbytes'
[336, 344) 'bytesread'
[368, 376) 'dims'
[400, 404) 'do_clean'
[416, 420) 'j'
[432, 436) 'len'
[448, 452) 'len_pad'
[464, 468) 'len1'
[480, 504) 'buf'
[544, 552) 'readresult'
[576, 580) 'len2'
[592, 596) 'len_pad3'
[608, 612) 'len4'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /matio-1.5.17/src/mat5.c:4856 Mat_VarReadNextInfo5
Shadow bytes around the buggy address:
0x10007e75ec10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec40: f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 04 f2 04 f2
0x10007e75ec50: 04 f2 00 f2 f2 f2 00 f2 f2 f2 04 f2 00 00 00 00
=>0x10007e75ec60: 00 00 00 00[f2]f2 f2 f2 04 f2 00 f2 f2 f2 00 f2
0x10007e75ec70: f2 f2 04 f2 04 f2 04 f2 04 f2 04 f2 00 00 00 f2
0x10007e75ec80: f2 f2 f2 f2 00 f2 f2 f2 04 f2 04 f2 04 f3 f3 f3
0x10007e75ec90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75eca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ecb0: f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 f3 f3 f3
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==21267==ABORTING |
Stack-buffer-overflow while running motio-1.5.17. I can not confirm if this bug is needed to patch. Deatil log as follow: (POC in attachment)
lbb@lbb: ./bin/matdump poc_m00
InflateRankDims: inflate returned data error
=================================================================
==21267==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffff3b36320 at pc 0x7f31a19c7187 bp 0x7ffff3b357f0 sp 0x7ffff3b357e8
READ of size 4 at 0x7ffff3b36320 thread T0
#0 0x7f31a19c7186 in Mat_VarReadNextInfo5 /matio-1.5.17/src/mat5.c:4856:47
#1 0x7f31a1a22911 in Mat_VarReadNextInfo /matio-1.5.17/src/mat.c:2311:22
#2 0x4dd9b3 in main /matio-1.5.17/tools/matdump.c:942:31
#3 0x7f31a059f82f in __libc_start_main /build/glibc-LK5gWL/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x435a28 in _start (/matio-1.5.17/build/bin/matdump+0x435a28)
Address 0x7ffff3b36320 is located in stack of thread T0 at offset 288 in frame
#0 0x7f31a19c4a5f in Mat_VarReadNextInfo5 /matio-1.5.17/src/mat5.c:4753
This frame has 22 object(s):
[32, 40) ''
[64, 72) ''
[96, 100) 'err'
[112, 116) 'data_type'
[128, 132) 'nBytes'
[144, 152) 'fpos'
[176, 184) 'matvar'
[208, 212) 'array_flags'
[224, 288) 'uncomp_buf' <== Memory access at offset 288 overflows this variable
[320, 324) 'nbytes'
[336, 344) 'bytesread'
[368, 376) 'dims'
[400, 404) 'do_clean'
[416, 420) 'j'
[432, 436) 'len'
[448, 452) 'len_pad'
[464, 468) 'len1'
[480, 504) 'buf'
[544, 552) 'readresult'
[576, 580) 'len2'
[592, 596) 'len_pad3'
[608, 612) 'len4'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /matio-1.5.17/src/mat5.c:4856 Mat_VarReadNextInfo5
Shadow bytes around the buggy address:
0x10007e75ec10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ec40: f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 04 f2 04 f2
0x10007e75ec50: 04 f2 00 f2 f2 f2 00 f2 f2 f2 04 f2 00 00 00 00
=>0x10007e75ec60: 00 00 00 00[f2]f2 f2 f2 04 f2 00 f2 f2 f2 00 f2
0x10007e75ec70: f2 f2 04 f2 04 f2 04 f2 04 f2 04 f2 00 00 00 f2
0x10007e75ec80: f2 f2 f2 f2 00 f2 f2 f2 04 f2 04 f2 04 f3 f3 f3
0x10007e75ec90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75eca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10007e75ecb0: f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 f3 f3 f3
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==21267==ABORTING |
|
