Package: advancecomp
Version: 2.0-1
Severity: important
Tags: security
heap buffer overflow running advzip with "-l poc" option
Running 'advzip -l poc' with the attached file raises heap buffer overflow
which may allow a remote attacker to cause unspecified impact including
denial-of-service attack
I expected the program to terminate without segfault, but the program crashes
as follow
june@june:~/temp/report/advzip/00030552$ ../../binary/advancecomp-2.0/advzip -l
./poc
=
==9858==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060effd
at pc 0x76e9af7f bp 0x7fffd6c0 sp 0x7fffce70
READ of size 2020 at 0x6060effd thread T0
#0 0x76e9af7e (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e)
#1 0x55579c2a in zip_entry::load_cent(unsigned char const*, unsigned
int&) /home/june/temp/report/binary/advancecomp-2.0/zip.cc:722
#2 0x5557b56f in zip::open()
/home/june/temp/report/binary/advancecomp-2.0/zip.cc:867
#3 0x5556e7a6 in list_single(std::__cxx11::basic_string, std::allocator > const&, bool)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:122
#4 0x5556f8b2 in list_all(int, char**, bool)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:261
#5 0x5557214c in process(int, char**)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:613
#6 0x55572446 in main
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:623
#7 0x760082b0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
#8 0x5556daf9 in _start
(/home/june/temp/report/binary/advancecomp-2.0/advzip+0x19af9)
0x6060effd is located 0 bytes to the right of 61-byte region
[0x6060efc0,0x6060effd)
allocated by thread T0 here:
#0 0x76effd28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
#1 0x55583a4a in data_alloc(unsigned int)
/home/june/temp/report/binary/advancecomp-2.0/data.cc:51
#2 0x55573af2 in cent_read(_IO_FILE*, unsigned int, unsigned char*&,
unsigned int&) /home/june/temp/report/binary/advancecomp-2.0/zip.cc:113
#3 0x5557b3c5 in zip::open()
/home/june/temp/report/binary/advancecomp-2.0/zip.cc:847
#4 0x5556e7a6 in list_single(std::__cxx11::basic_string, std::allocator > const&, bool)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:122
#5 0x5556f8b2 in list_all(int, char**, bool)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:261
#6 0x5557214c in process(int, char**)
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:613
#7 0x55572446 in main
/home/june/temp/report/binary/advancecomp-2.0/rezip.cc:623
#8 0x760082b0 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
SUMMARY: AddressSanitizer: heap-buffer-overflow
(/usr/lib/x86_64-linux-gnu/libasan.so.3+0x5cf7e)
Shadow bytes around the buggy address:
0x0c0c7fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0c7fff9df0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00[05]
0x0c0c7fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user:f7
Container overflow: fc
Array cookie:ac
Intra object redzone:bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone:cb
==9858==ABORTING
This bug was found with a fuzzer developed by 'SoftSec' group at KAIST
-- System Information:
Debian Release: 9.3
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'),
(500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages advancecomp depends on:
ii libc6 2.24-11+deb9u1
ii libgcc1 1:6.3.0-18
ii libstdc++6 6.3.0-18
ii zlib1g
