[Nasm-bugs] [Bug 3392563] New: Use after free in do_directive
noreply-nasm at gorcunov.org
noreply-nasm at gorcunov.org
Wed Mar 13 13:45:04 PDT 2019
https://bugzilla.nasm.us/show_bug.cgi?id=3392563
Bug ID: 3392563
Summary: Use after free in do_directive
Product: NASM
Version: 2.15 (development)
Hardware: All
OS: All
Status: OPEN
Severity: normal
Priority: Medium
Component: Assembler
Assignee: nobody at nasm.us
Reporter: bugs-syssec at rub.de
CC: chang.seok.bae at intel.com, gorcunov at gmail.com,
hpa at zytor.com, nasm-bugs at nasm.us
Obtained from: Built from git using configure
Created attachment 411717
--> https://bugzilla.nasm.us/attachment.cgi?id=411717&action=edit
uaf-do_directive.asm
While fuzzing NASM, an use after free in do_directive was discovered. It can be
triggered by running `./nasm uaf-do_directive.asm`
This bug is probably related to
https://bugzilla.nasm.us/show_bug.cgi?id=3392555.
Version:
NASM version 2.15rc0 compiled on Mar 13 2019
git master (commit 0bddd0f1b14aa614e1dd1c14297527dc24dee29c)
Valgrind output:
```
==25264== Memcheck, a memory error detector
==25264== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==25264== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info
==25264== Command: ./nasm-plain do_directive.asm
==25264==
do_directive.asm:1: error: `%macro' expects a parameter count
do_directive.asm:1: warning: too many default macro parameters in macro `jsi'
[-w+macro-defaults]
do_directive.asm:5: error: unterminated %[ construct
do_directive.asm:7: error: (jsi:1) symbol `__float80e__.. at 0.z' not defined
before use
do_directive.asm:2: ... from macro `jsi' defined here
do_directive.asm:7: warning: (jsi:2) trailing garbage after `%clear' ignored
[-w+other]
do_directive.asm:3: ... from macro `jsi' defined here [-w+other]
==25264== Invalid read of size 4
==25264== at 0x170392: pp_getline (preproc.c:5079)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1e10 is 144 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x17007A: pp_getline (preproc.c:5131)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1da8 is 40 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x16C83D: do_directive (preproc.c:2237)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1da8 is 40 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x16D3C5: do_directive (preproc.c:2918)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1d90 is 16 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 4
==25264== at 0x16D3CC: do_directive (preproc.c:2922)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1df8 is 120 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 4
==25264== at 0x16D3D6: do_directive (preproc.c:2925)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1dfc is 124 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 4
==25264== at 0x16D3E1: do_directive (preproc.c:2927)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1df8 is 120 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid write of size 4
==25264== at 0x16D3EF: do_directive (preproc.c:2931)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1dfc is 124 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x16FE1C: pp_getline (preproc.c:4981)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1d90 is 16 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x1700D4: pp_getline (preproc.c:5040)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1d90 is 16 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x1700D9: pp_getline (preproc.c:5039)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1dd8 is 88 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x1700E7: pp_getline (preproc.c:5046)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1d88 is 8 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x1705D8: pp_getline (preproc.c:5050)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1de8 is 104 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x1705E1: pp_getline (preproc.c:5051)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1df0 is 112 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid read of size 8
==25264== at 0x170618: pp_getline (preproc.c:5052)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1e00 is 128 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264== Invalid write of size 8
==25264== at 0x170628: pp_getline (preproc.c:5053)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Address 0x4ab1da8 is 40 bytes inside a block of size 176 free'd
==25264== at 0x48389AB: free (vg_replace_malloc.c:530)
==25264== by 0x16A087: free_mmacro_table.constprop.10 (preproc.c:646)
==25264== by 0x16D6D3: free_macros (preproc.c:654)
==25264== by 0x16D6D3: do_directive (preproc.c:2512)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264== Block was alloc'd at
==25264== at 0x4839B65: calloc (vg_replace_malloc.c:752)
==25264== by 0x15D4A0: nasm_zalloc (alloc.c:76)
==25264== by 0x16DB4B: do_directive (preproc.c:2795)
==25264== by 0x1703EE: pp_getline (preproc.c:5138)
==25264== by 0x15CE21: assemble_file (nasm.c:1549)
==25264== by 0x15ADC7: main (nasm.c:609)
==25264==
==25264==
==25264== HEAP SUMMARY:
==25264== in use at exit: 92,544 bytes in 13 blocks
==25264== total heap usage: 1,210 allocs, 1,197 frees, 327,679 bytes
allocated
==25264==
==25264== LEAK SUMMARY:
==25264== definitely lost: 32 bytes in 1 blocks
==25264== indirectly lost: 0 bytes in 0 blocks
==25264== possibly lost: 0 bytes in 0 blocks
==25264== still reachable: 92,512 bytes in 12 blocks
==25264== suppressed: 0 bytes in 0 blocks
==25264== Rerun with --leak-check=full to see details of leaked memory
==25264==
==25264== For counts of detected and suppressed errors, rerun with: -v
==25264== ERROR SUMMARY: 17 errors from 16 contexts (suppressed: 0 from 0)
```
--
You are receiving this mail because:
You are on the CC list for the bug.
You are watching all bug changes.
More information about the Nasm-bugs
mailing list