https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=279772
Bug ID: 279772
Summary: use (write) after free in libedit's
em_copy_prev_word()
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: bin
Assignee: [email protected]
Reporter: [email protected]
Attachment #251479 text/plain
mime type:
Created attachment 251479
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=251479&action=edit
demo of a use-after-free in libedit's em_copy_prev_word()
em_copy_prev_word() in contrib/libedit/emacs.c:
oldc = el->el_line.cursor;
/* does a bounds check */
cp = c__prev_word(el->el_line.cursor, el->el_line.buffer,
el->el_state.argument, ce__isword);
c_insert(el, (int)(oldc - cp));
for (dp = oldc; cp < oldc && dp < el->el_line.lastchar; cp++)
*dp++ = *cp;
c_insert() can call realloc() on el->el_line.buffer. This means that
oldc and cp can end up pointing into the old buffer that realloc()
freed. Then the assignment in the for loop reads and writes freed
memory.
I've attached a demo of this in sh's use of libedit. The demo requires
/usr/local/bin/valgrind.
$ cc sh11a.c -lutil
$ ./a.out
..
Invalid read of size 4
at 0x487C1AC: em_copy_prev_word (rtm/freebsd/contrib/libedit/emacs.c:458)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
Address 0x553d160 is 0 bytes inside a block of size 8,192 free'd
at 0x4851951: realloc (vg_replace_malloc.c:1694)
by 0x48732AA: ch_enlargebufs (rtm/freebsd/contrib/libedit/chared.c:502)
by 0x487318C: c_insert (rtm/freebsd/contrib/libedit/chared.c:104)
by 0x487C16A: em_copy_prev_word (rtm/freebsd/contrib/libedit/emacs.c:456)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
Block was alloc'd at
at 0x4851951: realloc (vg_replace_malloc.c:1694)
by 0x48732AA: ch_enlargebufs (rtm/freebsd/contrib/libedit/chared.c:502)
by 0x4875B8D: ed_insert (rtm/freebsd/contrib/libedit/common.c:86)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
Invalid write of size 4
at 0x487C1BD: em_copy_prev_word (rtm/freebsd/contrib/libedit/emacs.c:458)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
Address 0x553e164 is 4,100 bytes inside a block of size 8,192 free'd
at 0x4851951: realloc (vg_replace_malloc.c:1694)
by 0x48732AA: ch_enlargebufs (rtm/freebsd/contrib/libedit/chared.c:502)
by 0x487318C: c_insert (rtm/freebsd/contrib/libedit/chared.c:104)
by 0x487C16A: em_copy_prev_word (rtm/freebsd/contrib/libedit/emacs.c:456)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
Block was alloc'd at
at 0x4851951: realloc (vg_replace_malloc.c:1694)
by 0x48732AA: ch_enlargebufs (rtm/freebsd/contrib/libedit/chared.c:502)
by 0x4875B8D: ed_insert (rtm/freebsd/contrib/libedit/common.c:86)
by 0x4889747: el_wgets (rtm/freebsd/contrib/libedit/read.c:540)
by 0x4879B3C: el_gets (rtm/freebsd/contrib/libedit/eln.c:75)
by 0x123D6E: preadfd (rtm/freebsd/bin/sh/input.c:138)
by 0x12387A: preadbuffer (rtm/freebsd/bin/sh/input.c:210)
by 0x1326C5: xxreadtoken (rtm/freebsd/bin/sh/parser.c:910)
by 0x12E4FC: readtoken (rtm/freebsd/bin/sh/parser.c:827)
by 0x12E379: parsecmd (rtm/freebsd/bin/sh/parser.c:222)
by 0x129786: cmdloop (rtm/freebsd/bin/sh/main.c:206)
by 0x1295D2: main (rtm/freebsd/bin/sh/main.c:167)
--
You are receiving this mail because:
You are the assignee for the bug.
