Hi Vim-7.4.729 accesses invalid memory (global overflow) when doing:
$ vim -u NONE -c 'set re=1' \
-c 'e ++enc=utf8 ++bad=keep crash-5' \
-c 'call search(getline("."))'
... where crash-5 is the attached file (8 bytes).
Asan reports:
==5792==ERROR: AddressSanitizer: global-buffer-overflow on address
0x0000011f58e7 at pc 0xafd150 bp 0x7ffcc79a6ee0 sp 0x7ffcc79a6ed8
READ of size 1 at 0x0000011f58e7 thread T0
#0 0xafd14f in utf_head_off /home/pel/sb/vim/src/mbyte.c:3514
#1 0xd978ad in regmatch /home/pel/sb/vim/src/regexp.c:5588
#2 0xd978ad in regtry /home/pel/sb/vim/src/regexp.c:4099
#3 0xd9d845 in bt_regexec_both /home/pel/sb/vim/src/regexp.c:3988
#4 0xdc439a in vim_regexec_multi /home/pel/sb/vim/src/regexp.c:8275
#5 0xe87449 in searchit /home/pel/sb/vim/src/search.c:639
#6 0x593533 in search_cmn /home/pel/sb/vim/src/eval.c:16366
#7 0x593533 in f_search /home/pel/sb/vim/src/eval.c:16516
#8 0x611d47 in call_func /home/pel/sb/vim/src/eval.c:8765
#9 0x63e3dc in get_func_tv /home/pel/sb/vim/src/eval.c:8565
#10 0x65ac39 in ex_call /home/pel/sb/vim/src/eval.c:3510
#11 0x75aa1d in do_one_cmd /home/pel/sb/vim/src/ex_docmd.c:2940
#12 0x77016d in do_cmdline /home/pel/sb/vim/src/ex_docmd.c:1133
#13 0x4237c6 in exe_commands /home/pel/sb/vim/src/main.c:2922
#14 0x4237c6 in main /home/pel/sb/vim/src/main.c:958
#15 0x7fca25193ec4 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
#0 0x42a5e9 in _start ??:?
0x0000011f58e7 is located 57 bytes to the left of global variable
'*.LC18' from 'regexp.c' (0x11f5920) of size 2
'*.LC18' is ascii string '\'
0x0000011f58e7 is located 6 bytes to the right of global variable
'*.LC17' from 'regexp.c' (0x11f58e0) of size 1
'*.LC17' is ascii string ''
SUMMARY: AddressSanitizer: global-buffer-overflow
/home/pel/sb/vim/src/mbyte.c:3514 utf_head_off
Shadow bytes around the buggy address:
0x000080236ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x000080236b10: 00 00 00 00 00 00 00 00 00 00 00 00[01]f9 f9 f9
0x000080236b20: f9 f9 f9 f9 02 f9 f9 f9 f9 f9 f9 f9 00 00 00 06
0x000080236b30: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000080236b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Contiguous container OOB:fc
ASan internal: fe
==5792==ABORTING
Code in regexp.c:5588
5583 else
5584 {
5585 #ifdef FEAT_MBYTE
5586 if (has_mbyte)
5587 rp->rs_un.regsave.rs_u.pos.col -=
5588 (*mb_head_off)(regline, regline
5589 +
rp->rs_un.regsave.rs_u.pos.col - 1) + 1;
5590 else
5591 #endif
When bug happens:
* rp->rs_un.regsave.rs_u.pos.col - 1 is equal to 7
* regline is an empty string which has been set by
reg_getline() at line 3718:
3708 static char_u *
3709 reg_getline(lnum)
3710 linenr_T lnum;
3711 {
3712 /* when looking behind for a match/no-match lnum is negative. But we
3713 * can't go before line 1 */
3714 if (reg_firstlnum + lnum < 1)
3715 return NULL;
3716 if (lnum > reg_maxline)
3717 /* Must have matched the "\n" in the last line. */
!3718 return (char_u *)"";
3719 return ml_get_buf(reg_buf, reg_firstlnum + lnum, FALSE);
3720 }
So "regline + rp->rs_un.regsave.rs_u.pos.col - 1" at regexp.c:5588
is pointing to invalid memory (global overflow).
Bug was found by afl-fuzz (http://lcamtuf.coredump.cx/afl/).
Sorry, no patch as I don't know how to fix it.
Regards
Dominique
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
crash-5
Description: Binary data
