### Description heap-buffer-overflow indent/src/output.c:319 in set_buf_break. CVE-2023-40305 has heap-buffer-overflow in search_brace, but this bug is in set_buf_break in indent/src/output.c POC file is attached
### GNU indent Version ``` GNU indent 2.2.13 ``` ### Steps to recreate ``` cd indent autoreconf -i ./configure --disable-nls make indent ./poc ``` ### POC [poc](https://paste.debian.net/download/1304713) ### Crash Info ``` -> indent/src/indent id:000012,sig:06,src:000003,time:58344633,execs:1235790,op:arith8,pos:7267,val:+30 /home/output ================================================================= ==1429449==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000003ec at pc 0x55d7c332e0d1 bp 0x7ffc002e4940 sp 0x7ffc002e4938 READ of size 2 at 0x6020000003ec thread T0 #0 0x55d7c332e0d0 in set_buf_break /home/nu1lptr/afl/indent/src/output.c:319:13 #1 0x55d7c33047c7 in indent_main_loop /home/nu1lptr/afl/indent/src/indent.c:640:17 #2 0x55d7c33047c7 in indent /home/nu1lptr/afl/indent/src/indent.c:759:12 #3 0x55d7c32ff361 in indent_multiple_files /home/nu1lptr/afl/indent/src/indent.c:938:18 #4 0x55d7c32ff361 in indent_all /home/nu1lptr/afl/indent/src/indent.c:1036:23 #5 0x55d7c32ff361 in main /home/nu1lptr/afl/indent/src/indent.c:1123:23 #6 0x7fb444e29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #7 0x7fb444e29e3f in __libc_start_main csu/../csu/libc-start.c:392:3 #8 0x55d7c3225324 in _start (/home/nu1lptr/afl/indent/src/indent+0x6a324) (BuildId: bf919c9b1b6dfa4b) 0x6020000003ec is located 4 bytes before 16-byte region [0x6020000003f0,0x602000000400) allocated by thread T0 here: #0 0x55d7c32bf338 in calloc (/home/nu1lptr/afl/indent/src/indent+0x104338) (BuildId: bf919c9b1b6dfa4b) #1 0x55d7c332912c in xmalloc /home/nu1lptr/afl/indent/src/globs.c:42:17 #2 0x55d7c3304904 in indent_main_loop /home/nu1lptr/afl/indent/src/indent.c:672:9 #3 0x55d7c3304904 in indent /home/nu1lptr/afl/indent/src/indent.c:759:12 #4 0x55d7c32ff361 in indent_multiple_files /home/nu1lptr/afl/indent/src/indent.c:938:18 #5 0x55d7c32ff361 in indent_all /home/nu1lptr/afl/indent/src/indent.c:1036:23 #6 0x55d7c32ff361 in main /home/nu1lptr/afl/indent/src/indent.c:1123:23 #7 0x7fb444e29d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/nu1lptr/afl/indent/src/output.c:319:13 in set_buf_break Shadow bytes around the buggy address: 0x602000000100: fa fa 06 fa fa fa 06 fa fa fa 06 fa fa fa 06 fa 0x602000000180: fa fa 06 fa fa fa 06 fa fa fa 07 fa fa fa 07 fa 0x602000000200: fa fa 00 fa fa fa 00 02 fa fa fd fa fa fa fd fa 0x602000000280: fa fa fd fa fa fa fd fd fa fa 00 fa fa fa fd fa 0x602000000300: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fd =>0x602000000380: fa fa fd fd fa fa fd fd fa fa fd fd fa[fa]00 00 0x602000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x602000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x602000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x602000000580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x602000000600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1429449==ABORTING ``` ### System Info Linux ip-10-0-1-50 6.2.0-1013-aws #13~22.04.1-Ubuntu SMP Fri Sep 8 17:29:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0 ### CREDIT [INFOSECIITR](https://infoseciitr.in)
