Hi, I built CPIO 2.11+dfsg (with Debian patches) and fuzzed it using afl-fuzz with address sanitizer turned on. Here's an example crash I got with base64-encoded archive "EAEBcceSlAFxx5KSkpIAQJKSx5IBcccAAJKSAECSkgA=":
root@1442a2c3a089:~/fuzz/cpio# /root/pkg/cpio-2.11+dfsg/obj/src/cpio
-idmv <
o/crashes/id\:000000\,sig\:06\,src\:000011\,op\:int16\,pos\:23\,val\:+0
/root/pkg/cpio-2.11+dfsg/obj/src/cpio: warning: skipped 3 bytes of junk
/root/pkg/cpio-2.11+dfsg/obj/src/cpio: warning: archive header has
reverse byte-order
=================================================================
==20289==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x60200000efd1 at pc 0x7f80edb61988 bp 0x7fff7dc9cbd0 sp 0x7fff7dc9c380
READ of size 1 at 0x60200000efd1 thread T0
#0 0x7f80edb61987 in strchr
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x6e987)
#1 0x417e48 in path_contains_symlink ../../src/copyin.c:718
#2 0x417e48 in process_copy_in ../../src/copyin.c:1522
#3 0x404a6b in main ../../src/main.c:746
#4 0x7f80ed76bb44 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#5 0x40661a (/root/pkg/cpio-2.11+dfsg/obj/src/cpio+0x40661a)
0x60200000efd1 is located 0 bytes to the right of 1-byte region
[0x60200000efd0,0x60200000efd1)
allocated by thread T0 here:
#0 0x7f80edb8737a in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9437a)
#1 0x4b0c84 in xmalloc ../../gnu/xmalloc.c:47
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strchr
Shadow bytes around the buggy address:
0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9df0: fa fa fa fa fa fa fa fa fa fa[01]fa fa fa 05 fa
0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==20289==ABORTING
I attach other crashes. Please let me know if there's anybody who can
fix it here, otherwise I'll be trying to file bug reports for Debian.
Cheers,
d33tah
cpio-2.11+dfsg-afl-fuzz-asan.tar.gz
Description: application/gzip
signature.asc
Description: OpenPGP digital signature
