subject:"\[sqlite\] a couple of crashing bugs from a fuzzer"

Re: [sqlite] a couple of crashing bugs from a fuzzer

2015-01-09 Thread Andreas Kupries

The fuzzer seems to be
http://lcamtuf.coredump.cx/afl/

And an interesting blog post about it is
http://lcamtuf.blogspot.ca/2014/11/pulling-jpegs-out-of-thin-air.html

American fuzzy lop is a security-oriented fuzzer that employs a
novel type of compile-time instrumentation and genetic algorithms to
automatically discover clean, interesting test cases that trigger new
internal states in the targeted binary.


On Thu, Jan 8, 2015 at 5:29 PM, Richard Hipp  wrote:
> On 1/8/15, Michal Zalewski  wrote:
>
>> I have been running afl-fuzz against sqlite and bumped in a bunch of
>> bugs that seem to crash the sqlite3 binary
>
> Fixed here: https://www.sqlite.org/src/info/fe578863313128
>
> Bug report for your trophy case: 
> https://www.sqlite.org/src/info/a59ae93ee990a55
>
> Nice work.  I've never heard of afl-fuzz before, but you can bet I'm
> going to be studying up on it!
>
>
>  (but do not seem to be a
>> security problem, other than in the denial-of-service sense). There
>> are four seemingly distinct patterns, with test cases included inline:
>>
>> -- test1.sql --
>> create table t0(t);insert into t0
>> select strftime();
>> -- eof --
>>
>> This one is a failure in:
>>
>> sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
>> 20567   if( db->mallocFailed ){
>>
>> where db looks like something in the vicinity of NULL.
>>
>> #0  sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
>> #1  0x0053b17c in sqlite3VdbeMemGrow
>> (pMem=pMem@entry=0xa9f4d8, n=, n@entry=32,
>> bPreserve=bPreserve@entry=0) at sqlite3.c:61789
>> #2  0x0057c904 in sqlite3VdbeMemClearAndResize (szNew=32,
>> pMem=0xa9f4d8) at sqlite3.c:61831
>> #3  sqlite3VdbeMemStringify (pMem=0xa9f4d8, enc=,
>> bForce=) at sqlite3.c:61949
>> #4  0x0057cf40 in valueToText (pVal=0xa9f4d8, enc=enc@entry=1
>> '\001') at sqlite3.c:62681
>> #5  0x0057d166 in sqlite3ValueText (pVal=,
>> enc=1 '\001') at sqlite3.c:62714
>> #6  0x00598fcd in sqlite3_value_text (pVal=) at
>> sqlite3.c:67471
>> #7  strftimeFunc (context=0x7fffca90, argc=0, argv=0xa9f358) at
>> sqlite3.c:15657
>>
>> -- test2.sql --
>> DETACH(select group_concat(q));
>> -- eof --
>>
>> That one looks like a distinct NULL ptr deref:
>>
>> exprSrcCount (pWalker=, pExpr=0xa9eec8) at sqlite3.c:84694
>> 84694   for(i=0; inSrc; i++){
>>
>> #0  exprSrcCount (pWalker=, pExpr=0xa9eec8) at
>> sqlite3.c:84694
>> #1  0x004fb86f in sqlite3WalkExpr (pWalker=0x7fffc400,
>> pExpr=0xa9eec8) at sqlite3.c:79072
>> #2  0x0069193f in sqlite3WalkExprList (p=,
>> pWalker=0x7fffc400) at sqlite3.c:79095
>> #3  sqlite3FunctionUsesThisSrc (pExpr=0xa9ed48, pSrcList=0x0) at
>> sqlite3.c:19186
>> #4  resolveExprStep (pWalker=pWalker@entry=0x7fffc480,
>> pExpr=pExpr@entry=0xa9ed48) at sqlite3.c:14402
>> #5  0x00692bcb in sqlite3WalkExpr (pExpr=0xa9ed48,
>> pWalker=0x7fffc480) at sqlite3.c:79072
>> #6  sqlite3ResolveExprNames (pNC=0x7fffc550, pExpr=0xa9ed48) at
>> sqlite3.c:15026
>> #7  0x00694b2b in resolveSelectStep (pWalker=,
>> p=) at sqlite3.c:80402
>> ...
>>
>> -- test3.sql --
>> select(select strftime());
>> -- eof --
>>
>> Faults in:
>>
>> sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
>> 62708 if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) &&
>> pVal->enc==enc ){
>>
>> #0  sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
>> #1  0x00598fcd in sqlite3_value_text (pVal=) at
>> sqlite3.c:67471
>> #2  strftimeFunc (context=0x7fffca90, argc=0, argv=0xaa02d8) at
>> sqlite3.c:15657
>> #3  0x007883fb in sqlite3VdbeExec (p=0xa8d5a8) at sqlite3.c:70606
>> #4  0x007aaf11 in sqlite3Step (p=0xaa0018) at sqlite3.c:67809
>> #5  sqlite3_step (pStmt=) at sqlite3.c:2339
>> #6  0x00425228 in shell_exec (db=0xa8d5a8,
>> zSql=zSql@entry=0xa8d510 "select(select strftime());",
>> pArg=pArg@entry=0x7fffcf50,
>> pzErrMsg=pzErrMsg@entry=0x7fffce68, xCallback=0x41dd80
>> )
>> at shell.c:1365
>> #7  0x0042a933 in process_input (p=p@entry=0x7fffcf50,
>> in=0x77565640 <_IO_2_1_stdin_>) at shell.c:3697
>>
>> -- test4.sql --
>> select n()AND+#00;
>> -- eof --
>>
>> This dies for me at:
>>
>> #0  sqlite3ExprIsInteger (p=p@entry=0xa9edb8,
>> pValue=pValue@entry=0x7fffc9a4) at sqlite3.c:16463
>> #1  0x004f3aed in sqlite3ExprIsInteger (pValue=0x7fffc9a4,
>> p=0xa9edb8) at sqlite3.c:81085
>> #2  exprAlwaysFalse (p=0xa9edb8) at sqlite3.c:15665
>> #3  sqlite3ExprAnd (db=0xa8d598, pLeft=0xa9eeb8, pRight=0xa9edb8) at
>> sqlite3.c:15682
>> #4  0x00687b86 in sqlite3PExpr (pParse=0xa9f0c8, op=72,
>> pLeft=0xa9eeb8, pRight=0xa9edb8, pToken=0x0)
>> at sqlite3.c:81167
>> #5  0x00752a7c in spanBinaryExpr (pLeft=,
>> pLeft=, pRight=,
>> pRight=, op=, pParse=> out>, pOut=) at sqlite3.c:120313
>> #6  yy_reduce (yyruleno=, yypParser=) at
>> sqlite3.c:57482
>> #7  sqlite3Parser (yyp=0xa9f368, yymajor=-13916,

Re: [sqlite] a couple of crashing bugs from a fuzzer

2015-01-08 Thread jungle Boogie

Richard,
On 8 January 2015 at 17:29, Richard Hipp  wrote:
> On 1/8/15, Michal Zalewski  wrote:
>
>> I have been running afl-fuzz against sqlite and bumped in a bunch of
>> bugs that seem to crash the sqlite3 binary
>
> Fixed here: https://www.sqlite.org/src/info/fe578863313128
>
> Bug report for your trophy case: 
> https://www.sqlite.org/src/info/a59ae93ee990a55
>
> Nice work.  I've never heard of afl-fuzz before, but you can bet I'm
> going to be studying up on it!
>
>

I wish you would work at my company! I found two lazy coding bugs
today and it will probably be several weeks before anyone is
'authorized' to review the cases and then weeks to consider repair.

Contrast that with you: You're giving sqlite away and fixing bugs
within 8 hours!

OpenBSD people have found many bugs with afl, too.

-- 
---
inum: 883510009027723
sip: [email protected]
xmpp: [email protected]
___
sqlite-users mailing list
[email protected]
http://sqlite.org:8080/cgi-bin/mailman/listinfo/sqlite-users

Re: [sqlite] a couple of crashing bugs from a fuzzer

2015-01-08 Thread Richard Hipp

On 1/8/15, Michal Zalewski  wrote:

> I have been running afl-fuzz against sqlite and bumped in a bunch of
> bugs that seem to crash the sqlite3 binary

Fixed here: https://www.sqlite.org/src/info/fe578863313128

Bug report for your trophy case: https://www.sqlite.org/src/info/a59ae93ee990a55

Nice work.  I've never heard of afl-fuzz before, but you can bet I'm
going to be studying up on it!


 (but do not seem to be a
> security problem, other than in the denial-of-service sense). There
> are four seemingly distinct patterns, with test cases included inline:
>
> -- test1.sql --
> create table t0(t);insert into t0
> select strftime();
> -- eof --
>
> This one is a failure in:
>
> sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
> 20567   if( db->mallocFailed ){
>
> where db looks like something in the vicinity of NULL.
>
> #0  sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
> #1  0x0053b17c in sqlite3VdbeMemGrow
> (pMem=pMem@entry=0xa9f4d8, n=, n@entry=32,
> bPreserve=bPreserve@entry=0) at sqlite3.c:61789
> #2  0x0057c904 in sqlite3VdbeMemClearAndResize (szNew=32,
> pMem=0xa9f4d8) at sqlite3.c:61831
> #3  sqlite3VdbeMemStringify (pMem=0xa9f4d8, enc=,
> bForce=) at sqlite3.c:61949
> #4  0x0057cf40 in valueToText (pVal=0xa9f4d8, enc=enc@entry=1
> '\001') at sqlite3.c:62681
> #5  0x0057d166 in sqlite3ValueText (pVal=,
> enc=1 '\001') at sqlite3.c:62714
> #6  0x00598fcd in sqlite3_value_text (pVal=) at
> sqlite3.c:67471
> #7  strftimeFunc (context=0x7fffca90, argc=0, argv=0xa9f358) at
> sqlite3.c:15657
>
> -- test2.sql --
> DETACH(select group_concat(q));
> -- eof --
>
> That one looks like a distinct NULL ptr deref:
>
> exprSrcCount (pWalker=, pExpr=0xa9eec8) at sqlite3.c:84694
> 84694   for(i=0; inSrc; i++){
>
> #0  exprSrcCount (pWalker=, pExpr=0xa9eec8) at
> sqlite3.c:84694
> #1  0x004fb86f in sqlite3WalkExpr (pWalker=0x7fffc400,
> pExpr=0xa9eec8) at sqlite3.c:79072
> #2  0x0069193f in sqlite3WalkExprList (p=,
> pWalker=0x7fffc400) at sqlite3.c:79095
> #3  sqlite3FunctionUsesThisSrc (pExpr=0xa9ed48, pSrcList=0x0) at
> sqlite3.c:19186
> #4  resolveExprStep (pWalker=pWalker@entry=0x7fffc480,
> pExpr=pExpr@entry=0xa9ed48) at sqlite3.c:14402
> #5  0x00692bcb in sqlite3WalkExpr (pExpr=0xa9ed48,
> pWalker=0x7fffc480) at sqlite3.c:79072
> #6  sqlite3ResolveExprNames (pNC=0x7fffc550, pExpr=0xa9ed48) at
> sqlite3.c:15026
> #7  0x00694b2b in resolveSelectStep (pWalker=,
> p=) at sqlite3.c:80402
> ...
>
> -- test3.sql --
> select(select strftime());
> -- eof --
>
> Faults in:
>
> sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
> 62708 if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) &&
> pVal->enc==enc ){
>
> #0  sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
> #1  0x00598fcd in sqlite3_value_text (pVal=) at
> sqlite3.c:67471
> #2  strftimeFunc (context=0x7fffca90, argc=0, argv=0xaa02d8) at
> sqlite3.c:15657
> #3  0x007883fb in sqlite3VdbeExec (p=0xa8d5a8) at sqlite3.c:70606
> #4  0x007aaf11 in sqlite3Step (p=0xaa0018) at sqlite3.c:67809
> #5  sqlite3_step (pStmt=) at sqlite3.c:2339
> #6  0x00425228 in shell_exec (db=0xa8d5a8,
> zSql=zSql@entry=0xa8d510 "select(select strftime());",
> pArg=pArg@entry=0x7fffcf50,
> pzErrMsg=pzErrMsg@entry=0x7fffce68, xCallback=0x41dd80
> )
> at shell.c:1365
> #7  0x0042a933 in process_input (p=p@entry=0x7fffcf50,
> in=0x77565640 <_IO_2_1_stdin_>) at shell.c:3697
>
> -- test4.sql --
> select n()AND+#00;
> -- eof --
>
> This dies for me at:
>
> #0  sqlite3ExprIsInteger (p=p@entry=0xa9edb8,
> pValue=pValue@entry=0x7fffc9a4) at sqlite3.c:16463
> #1  0x004f3aed in sqlite3ExprIsInteger (pValue=0x7fffc9a4,
> p=0xa9edb8) at sqlite3.c:81085
> #2  exprAlwaysFalse (p=0xa9edb8) at sqlite3.c:15665
> #3  sqlite3ExprAnd (db=0xa8d598, pLeft=0xa9eeb8, pRight=0xa9edb8) at
> sqlite3.c:15682
> #4  0x00687b86 in sqlite3PExpr (pParse=0xa9f0c8, op=72,
> pLeft=0xa9eeb8, pRight=0xa9edb8, pToken=0x0)
> at sqlite3.c:81167
> #5  0x00752a7c in spanBinaryExpr (pLeft=,
> pLeft=, pRight=,
> pRight=, op=, pParse= out>, pOut=) at sqlite3.c:120313
> #6  yy_reduce (yyruleno=, yypParser=) at
> sqlite3.c:57482
> #7  sqlite3Parser (yyp=0xa9f368, yymajor=-13916, yyminor=...,
> pParse=0x3d5, pParse@entry=0xa9f0c8) at sqlite3.c:58144
>
> /mz
> ___
> sqlite-users mailing list
> [email protected]
> http://sqlite.org:8080/cgi-bin/mailman/listinfo/sqlite-users
>


-- 
D. Richard Hipp
[email protected]
___
sqlite-users mailing list
[email protected]
http://sqlite.org:8080/cgi-bin/mailman/listinfo/sqlite-users

[sqlite] a couple of crashing bugs from a fuzzer

2015-01-08 Thread Michal Zalewski

Hey folks,

I have been running afl-fuzz against sqlite and bumped in a bunch of
bugs that seem to crash the sqlite3 binary (but do not seem to be a
security problem, other than in the denial-of-service sense). There
are four seemingly distinct patterns, with test cases included inline:

-- test1.sql --
create table t0(t);insert into t0
select strftime();
-- eof --

This one is a failure in:

sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
20567   if( db->mallocFailed ){

where db looks like something in the vicinity of NULL.

#0  sqlite3DbMallocRaw (db=0x2, n=32) at sqlite3.c:20567
#1  0x0053b17c in sqlite3VdbeMemGrow
(pMem=pMem@entry=0xa9f4d8, n=, n@entry=32,
bPreserve=bPreserve@entry=0) at sqlite3.c:61789
#2  0x0057c904 in sqlite3VdbeMemClearAndResize (szNew=32,
pMem=0xa9f4d8) at sqlite3.c:61831
#3  sqlite3VdbeMemStringify (pMem=0xa9f4d8, enc=,
bForce=) at sqlite3.c:61949
#4  0x0057cf40 in valueToText (pVal=0xa9f4d8, enc=enc@entry=1
'\001') at sqlite3.c:62681
#5  0x0057d166 in sqlite3ValueText (pVal=,
enc=1 '\001') at sqlite3.c:62714
#6  0x00598fcd in sqlite3_value_text (pVal=) at
sqlite3.c:67471
#7  strftimeFunc (context=0x7fffca90, argc=0, argv=0xa9f358) at
sqlite3.c:15657

-- test2.sql --
DETACH(select group_concat(q));
-- eof --

That one looks like a distinct NULL ptr deref:

exprSrcCount (pWalker=, pExpr=0xa9eec8) at sqlite3.c:84694
84694   for(i=0; inSrc; i++){

#0  exprSrcCount (pWalker=, pExpr=0xa9eec8) at sqlite3.c:84694
#1  0x004fb86f in sqlite3WalkExpr (pWalker=0x7fffc400,
pExpr=0xa9eec8) at sqlite3.c:79072
#2  0x0069193f in sqlite3WalkExprList (p=,
pWalker=0x7fffc400) at sqlite3.c:79095
#3  sqlite3FunctionUsesThisSrc (pExpr=0xa9ed48, pSrcList=0x0) at sqlite3.c:19186
#4  resolveExprStep (pWalker=pWalker@entry=0x7fffc480,
pExpr=pExpr@entry=0xa9ed48) at sqlite3.c:14402
#5  0x00692bcb in sqlite3WalkExpr (pExpr=0xa9ed48,
pWalker=0x7fffc480) at sqlite3.c:79072
#6  sqlite3ResolveExprNames (pNC=0x7fffc550, pExpr=0xa9ed48) at
sqlite3.c:15026
#7  0x00694b2b in resolveSelectStep (pWalker=,
p=) at sqlite3.c:80402
...

-- test3.sql --
select(select strftime());
-- eof --

Faults in:

sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
62708 if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) &&
pVal->enc==enc ){

#0  sqlite3ValueText (pVal=0x1, enc=1 '\001') at sqlite3.c:62708
#1  0x00598fcd in sqlite3_value_text (pVal=) at
sqlite3.c:67471
#2  strftimeFunc (context=0x7fffca90, argc=0, argv=0xaa02d8) at
sqlite3.c:15657
#3  0x007883fb in sqlite3VdbeExec (p=0xa8d5a8) at sqlite3.c:70606
#4  0x007aaf11 in sqlite3Step (p=0xaa0018) at sqlite3.c:67809
#5  sqlite3_step (pStmt=) at sqlite3.c:2339
#6  0x00425228 in shell_exec (db=0xa8d5a8,
zSql=zSql@entry=0xa8d510 "select(select strftime());",
pArg=pArg@entry=0x7fffcf50,
pzErrMsg=pzErrMsg@entry=0x7fffce68, xCallback=0x41dd80
)
at shell.c:1365
#7  0x0042a933 in process_input (p=p@entry=0x7fffcf50,
in=0x77565640 <_IO_2_1_stdin_>) at shell.c:3697

-- test4.sql --
select n()AND+#00;
-- eof --

This dies for me at:

#0  sqlite3ExprIsInteger (p=p@entry=0xa9edb8,
pValue=pValue@entry=0x7fffc9a4) at sqlite3.c:16463
#1  0x004f3aed in sqlite3ExprIsInteger (pValue=0x7fffc9a4,
p=0xa9edb8) at sqlite3.c:81085
#2  exprAlwaysFalse (p=0xa9edb8) at sqlite3.c:15665
#3  sqlite3ExprAnd (db=0xa8d598, pLeft=0xa9eeb8, pRight=0xa9edb8) at
sqlite3.c:15682
#4  0x00687b86 in sqlite3PExpr (pParse=0xa9f0c8, op=72,
pLeft=0xa9eeb8, pRight=0xa9edb8, pToken=0x0)
at sqlite3.c:81167
#5  0x00752a7c in spanBinaryExpr (pLeft=,
pLeft=, pRight=,
pRight=, op=, pParse=, pOut=) at sqlite3.c:120313
#6  yy_reduce (yyruleno=, yypParser=) at
sqlite3.c:57482
#7  sqlite3Parser (yyp=0xa9f368, yymajor=-13916, yyminor=...,
pParse=0x3d5, pParse@entry=0xa9f0c8) at sqlite3.c:58144

/mz
___
sqlite-users mailing list
[email protected]
http://sqlite.org:8080/cgi-bin/mailman/listinfo/sqlite-users

Re: [sqlite] a couple of crashing bugs from a fuzzer

Re: [sqlite] a couple of crashing bugs from a fuzzer

Re: [sqlite] a couple of crashing bugs from a fuzzer

[sqlite] a couple of crashing bugs from a fuzzer

4 matches

Site Navigation

Mail list logo

Footer information