Dear all,While fuzzing tcc, an out of bounds write was found in the sym_pop function.
Attached are a file producing a crash when compiled and the output of the clang address sanitizer and valgrind.
The asan report only shows an out of bounds read, valgrind also shows the out of bounds write.
There are multiple inputs leading to the same crash,
they are included in the attached file as comments.
To reproduce, compile the attached input file with tcc
tcc sym_pop-oob_read.c
The latest git version of tcc (commit
c4787e3626904fc542bd640cc368a9d306347008) was tested.
Credits: SysSec chair of Ruhr University Bochum
tcc: error: file '/home/prakti/Downloads/sym_pop-oob_read.c' not found
sym_pop-oob_write.c
Description: Binary data
==9395== Memcheck, a memory error detector ==9395== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==9395== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info ==9395== Command: ./tcc /home/prakti/Downloads/sym_pop-oob_write.c ==9395== ==9395== Invalid read of size 8 ==9395== at 0x40EDB3: global_identifier_push (tccgen.c:587) ==9395== by 0x42061D: asm_label_push (tccasm.c:51) ==9395== by 0x42061D: get_asm_sym (tccasm.c:70) ==9395== by 0x421AFC: asm_parse_directive (tccasm.c:679) ==9395== by 0x422EBA: tcc_assemble_internal (tccasm.c:927) ==9395== by 0x422F81: tcc_assemble_inline (tccasm.c:995) ==9395== by 0x423577: asm_global_instr (tccasm.c:1267) ==9395== by 0x415694: decl0.isra.25 (tccgen.c:7164) ==9395== by 0x41AA34: decl (tccgen.c:7383) ==9395== by 0x41AA34: tccgen_compile (tccgen.c:275) ==9395== by 0x4031B1: tcc_compile (libtcc.c:648) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== Address 0x58d3398 is 2,376 bytes inside a block of size 4,096 free'd ==9395== at 0x4C2FD5F: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9395== by 0x4039C8: tcc_realloc (libtcc.c:224) ==9395== by 0x405EEB: tok_alloc_new (tccpp.c:424) ==9395== by 0x40CF38: tccpp_new (tccpp.c:3674) ==9395== by 0x40439A: tcc_new (libtcc.c:757) ==9395== by 0x401A16: main (tcc.c:257) ==9395== Block was alloc'd at ==9395== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9395== by 0x4C2FDEF: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9395== by 0x4039C8: tcc_realloc (libtcc.c:224) ==9395== by 0x405EEB: tok_alloc_new (tccpp.c:424) ==9395== by 0x40CF38: tccpp_new (tccpp.c:3674) ==9395== by 0x40439A: tcc_new (libtcc.c:757) ==9395== by 0x401A16: main (tcc.c:257) ==9395== /home/prakti/Downloads/sym_pop-oob_write.c:33: error: , expected ==9395== Invalid read of size 8 ==9395== at 0x40EE2B: sym_pop (tccgen.c:613) ==9395== by 0x403144: tcc_compile (libtcc.c:657) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== Address 0x58e73e8 is 632 bytes inside a block of size 1,162 free'd ==9395== at 0x4C2EDEB: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9395== by 0x40CC29: preprocess_start (tccpp.c:3604) ==9395== by 0x40319B: tcc_compile (libtcc.c:638) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== Block was alloc'd at ==9395== at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==9395== by 0x403958: tcc_malloc (libtcc.c:207) ==9395== by 0x40397D: tcc_mallocz (libtcc.c:216) ==9395== by 0x403EB3: tcc_open_bf (libtcc.c:576) ==9395== by 0x4041FA: tcc_define_symbol (libtcc.c:686) ==9395== by 0x40CC29: preprocess_start (tccpp.c:3604) ==9395== by 0x40319B: tcc_compile (libtcc.c:638) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== ==9395== Invalid write of size 8 ==9395== at 0x40EE49: sym_pop (tccgen.c:618) ==9395== by 0x403144: tcc_compile (libtcc.c:657) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== Address 0x20 is not stack'd, malloc'd or (recently) free'd ==9395== ==9395== ==9395== Process terminating with default action of signal 11 (SIGSEGV) ==9395== Access not within mapped region at address 0x20 ==9395== at 0x40EE49: sym_pop (tccgen.c:618) ==9395== by 0x403144: tcc_compile (libtcc.c:657) ==9395== by 0x40478D: tcc_add_file_internal (libtcc.c:1064) ==9395== by 0x401B95: main (tcc.c:332) ==9395== If you believe this happened as a result of a stack ==9395== overflow in your program's main thread (unlikely but ==9395== possible), you can try to increase the size of the ==9395== main thread stack using the --main-stacksize= flag. ==9395== The main thread stack size used in this run was 8388608. ==9395== ==9395== HEAP SUMMARY: ==9395== in use at exit: 1,872,656 bytes in 70 blocks ==9395== total heap usage: 134 allocs, 64 frees, 1,931,016 bytes allocated ==9395== ==9395== LEAK SUMMARY: ==9395== definitely lost: 0 bytes in 0 blocks ==9395== indirectly lost: 0 bytes in 0 blocks ==9395== possibly lost: 0 bytes in 0 blocks ==9395== still reachable: 1,872,656 bytes in 70 blocks ==9395== suppressed: 0 bytes in 0 blocks ==9395== Rerun with --leak-check=full to see details of leaked memory ==9395== ==9395== For counts of detected and suppressed errors, rerun with: -v ==9395== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 0 from 0)
_______________________________________________ Tinycc-devel mailing list [email protected] https://lists.nongnu.org/mailman/listinfo/tinycc-devel
