mirrors/mc
1
0
Fork 0
mirror of https://github.com/MidnightCommander/mc synced 2025-01-08 20:41:59 +03:00
Code Issues Packages Projects Releases Wiki Activity
b2ffac752f
mc/lib
History
Andreas Mohr 8a6b2cb91c Ticket #4425: (mc_search__change_case_str): fix heap buffer overflow. 
Normal start result in this AddressSanitizer hit.

=================================================================
==17167==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200005b251 at pc 0x5983b1c3be5f bp 0x7ffcc27f4310 sp 0x7ffcc27f4308
WRITE of size 1 at 0x60200005b251 thread T0
    #0 0x5983b1c3be5e in mc_search__change_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:84:14
    #1 0x5983b1c3c03f in mc_search__toupper_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:200:12
    #2 0x5983b1d1b434 in mc_search__cond_struct_new_regex_hex_add /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:130:11
    #3 0x5983b1d1ad7f in mc_search__cond_struct_new_regex_accum_append /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:180:17
    #4 0x5983b1d147c9 in mc_search__cond_struct_new_regex_ci_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:251:5
    #5 0x5983b1d136fa in mc_search__cond_struct_new_init_regex /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:817:39
    #6 0x5983b1c3d7f0 in mc_search__cond_struct_new /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:80:9
    #7 0x5983b1c3d2e5 in mc_search_prepare /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:219:26
    #8 0x5983b1c3d9c3 in mc_search_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:297:10
    #9 0x5983b1c359f2 in mc_fhl_get_color_regexp /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:243:9
    #10 0x5983b1c35385 in mc_fhl_get_color /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:278:19
    #11 0x5983b1a1208f in file_compute_color /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:784:12
    #12 0x5983b1a10bfd in format_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:814:17
    #13 0x5983b1a0fb17 in repaint_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:954:15
    #14 0x5983b1a0c0b6 in paint_dir /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:1071:9
    #15 0x5983b19fab96 in panel_callback /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:3731:9
    #16 0x5983b1d08775 in widget_draw /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:539:19
    #17 0x5983b1d078eb in widget_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:841:17
    #18 0x5983b1cb3c0b in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #19 0x5983b1cb286c in group_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/group.c:691:17
    #20 0x5983b1caa8ab in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #21 0x5983b1cacd14 in dlg_init /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:540:5
    #22 0x5983b1cada9d in dlg_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:601:5
    #23 0x5983b19cddd9 in do_nc /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/filemanager.c:1827:16
    #24 0x5983b1999605 in main /tmp/portage/app-misc/mc-9999/work/mc-9999/src/main.c:455:21
    #25 0x7d3944d620cb  (/lib64/libc.so.6+0x220cb)
    #26 0x7d3944d6217b in __libc_start_main (/lib64/libc.so.6+0x2217b)
    #27 0x5983b18d7d10 in _start (/usr/bin/mc+0x277d10)

0x60200005b251 is located 0 bytes to the right of 1-byte region [0x60200005b250,0x60200005b251)
allocated by thread T0 here:
    #0 0x5983b195ee89 in malloc (/usr/bin/mc+0x2fee89)
    #1 0x7d3945014ef9 in g_malloc (/usr/lib64/libglib-2.0.so.0+0x54ef9)
    #2 0x5983b1c3c03f in mc_search__toupper_case_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:200:12
    #3 0x5983b1d1b434 in mc_search__cond_struct_new_regex_hex_add /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:130:11
    #4 0x5983b1d1ad7f in mc_search__cond_struct_new_regex_accum_append /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:180:17
    #5 0x5983b1d147c9 in mc_search__cond_struct_new_regex_ci_str /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:251:5
    #6 0x5983b1d136fa in mc_search__cond_struct_new_init_regex /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/regex.c:817:39
    #7 0x5983b1c3d7f0 in mc_search__cond_struct_new /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:80:9
    #8 0x5983b1c3d2e5 in mc_search_prepare /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:219:26
    #9 0x5983b1c3d9c3 in mc_search_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/search.c:297:10
    #10 0x5983b1c359f2 in mc_fhl_get_color_regexp /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:243:9
    #11 0x5983b1c35385 in mc_fhl_get_color /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/filehighlight/get-color.c:278:19
    #12 0x5983b1a1208f in file_compute_color /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:784:12
    #13 0x5983b1a10bfd in format_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:814:17
    #14 0x5983b1a0fb17 in repaint_file /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:954:15
    #15 0x5983b1a0c0b6 in paint_dir /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:1071:9
    #16 0x5983b19fab96 in panel_callback /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/panel.c:3731:9
    #17 0x5983b1d08775 in widget_draw /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:539:19
    #18 0x5983b1d078eb in widget_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/widget-common.c:841:17
    #19 0x5983b1cb3c0b in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #20 0x5983b1cb286c in group_default_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/group.c:691:17
    #21 0x5983b1caa8ab in widget_set_state /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/../../lib/widget/widget-common.h:383:12
    #22 0x5983b1cacd14 in dlg_init /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:540:5
    #23 0x5983b1cada9d in dlg_run /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/widget/dialog.c:601:5
    #24 0x5983b19cddd9 in do_nc /tmp/portage/app-misc/mc-9999/work/mc-9999/src/filemanager/filemanager.c:1827:16
    #25 0x5983b1999605 in main /tmp/portage/app-misc/mc-9999/work/mc-9999/src/main.c:455:21
    #26 0x7d3944d620cb  (/lib64/libc.so.6+0x220cb)

SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/app-misc/mc-9999/work/mc-9999/lib/search/lib.c:84:14 in mc_search__change_case_str
Shadow bytes around the buggy address:
  0x0c04800035f0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fa
  0x0c0480003600: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480003610: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fd
  0x0c0480003620: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480003630: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c0480003640: fa fa fd fa fa fa fd fa fa fa[01]fa fa fa fa fa
  0x0c0480003650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480003690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==17167==ABORTING

Found by clang 15.

Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Andrew Borodin <aborodin@vmail.ru>
2023-01-14 15:43:00 +03:00
..
event Update copyright years. 2022-03-13 13:17:26 +03:00
filehighlight Update copyright years. 2022-03-13 13:17:26 +03:00
mcconfig Ticket #4413: mcedit: syntax definitions in user location don't work. 2022-12-18 14:20:36 +03:00
search Ticket #4425: (mc_search__change_case_str): fix heap buffer overflow. 2023-01-14 15:43:00 +03:00
skin Update copyright years. 2022-03-13 13:17:26 +03:00
strutil Ticket #4374: fix file sort by version. 2022-06-04 09:01:43 +03:00
tty Ticket #4396: (tty_check_term): support Contour terminal. 2022-07-31 19:50:27 +03:00
vfs Ticket #4420: fail to build with only SFTP network VFS enabled. 2022-12-30 08:08:47 +03:00
widget (ins_from_clip): fix maybe-uninitialized warning. 2022-10-10 21:07:40 +03:00
charsets.c Update copyright years. 2022-03-13 13:17:26 +03:00
charsets.h (str_convert_to_input): make inline. 2021-03-14 19:30:42 +03:00
event-types.h Reimplement handling of ev_vfs_print_message_t message. 2015-11-05 14:33:21 +03:00
event.h Use argument names in function declarations. 2021-06-20 15:14:56 +03:00
filehighlight.h Ticket #4270: code clean up before 4.8.28 release. 2022-03-13 13:17:23 +03:00
fileloc.h Ticket #4413: mcedit: syntax definitions in user location don't work. 2022-12-18 14:20:36 +03:00
fs.h Ticket #3464: (compute_namelen): remove... 2015-05-24 17:59:18 +03:00
glibcompat.c Update copyright years. 2022-03-13 13:17:26 +03:00
glibcompat.h Use G_OPTION_ENTRY_NULL macro. 2021-06-20 15:14:56 +03:00
global.c Update copyright years. 2022-03-13 13:17:26 +03:00
global.h Ticket #1: remove SMB suport. 2021-09-26 10:03:49 +03:00
hook.c Update copyright years. 2022-03-13 13:17:26 +03:00
hook.h fixed doxygen documentation 2012-09-10 14:29:53 +03:00
keybind.c Update copyright years. 2022-03-13 13:17:26 +03:00
keybind.h lib/keybind.h: remove unneeded includes. 2021-11-21 15:00:39 +03:00
lock.c Update copyright years. 2022-03-13 13:17:26 +03:00
lock.h Changed lock_file() and unlock_file() functions 2012-03-06 11:52:30 +03:00
logging.c Update copyright years. 2022-03-13 13:17:26 +03:00
logging.h Clarify __attribute ((format (printf))) usage. 2015-11-05 14:33:20 +03:00
Makefile.am Drop mc_timer. Use g_get_real_time() instead. 2020-12-12 20:39:01 +03:00
mcconfig.h Ticket #3682: drop automatic migration of configuration 2021-02-22 21:16:52 +03:00
search.h mc_search: refactoring. 2022-10-10 21:07:40 +03:00
serialize.c Update copyright years. 2022-03-13 13:17:26 +03:00
serialize.h lib/mcconfig: fix coding style; apply source file template. 2019-09-01 19:41:12 +03:00
shell.c Update copyright years. 2022-03-13 13:17:26 +03:00
shell.h Fix typos. 2020-12-31 16:26:46 +03:00
skin.h Use argument names in function declarations. 2021-06-20 15:14:56 +03:00
stat-size.h Remove Cray support. 2020-10-13 16:34:55 +03:00
strescape.h Use argument names in function declarations. 2021-06-20 15:14:56 +03:00
strutil.h Ticket #4374: fix file sort by version. 2022-06-04 09:01:43 +03:00
timefmt.c Update copyright years. 2022-03-13 13:17:26 +03:00
timefmt.h Use argument names in function declarations. 2021-06-20 15:14:56 +03:00
unixcompat.h Sync with gnulib 4d4877e6c2123c4862c321f3eab28a55bf886216. 2018-11-24 14:40:42 +03:00
util.c Fix detection of zip-compressed file. 2022-10-09 14:06:25 +03:00
util.h Fix detection of zip-compressed file. 2022-10-09 14:06:25 +03:00
utilunix.c Ticket #4401: Segmentation fault in mcviewer. 2022-08-20 19:33:12 +03:00
utilunix.h Lib: removed includes to "src" directory 2011-03-21 23:55:52 +02:00
widget.h Create WBackground widget. 2020-03-08 20:17:29 +03:00