[Nasm-bugs] [Bug 3392814] New: global-buffer-overflow output/outdbg.c:459 in dbgdbg_typevalue

[noreply-nasm at dev.nasm.us]

https://bugzilla.nasm.us/show_bug.cgi?id=3392814

            Bug ID: 3392814
           Summary: global-buffer-overflow output/outdbg.c:459 in
                    dbgdbg_typevalue
           Product: NASM
           Version: 2.16 (development)
          Hardware: All
                OS: All
            Status: OPEN
          Severity: normal
          Priority: Medium
         Component: Assembler
          Assignee: nobody at nasm.us
          Reporter: 13579and24680 at gmail.com
                CC: chang.seok.bae at intel.com, gorcunov at gmail.com,
                    hpa at zytor.com, nasm-bugs at nasm.us
     Obtained from: Built from git using configure

Created attachment 411853
  --> https://bugzilla.nasm.us/attachment.cgi?id=411853&action=edit
poc from fuzzer and afl-tmin

(make asan)

$ sh autogen.sh
$ ./configure CFLAGS=' -g3 -fsanitize=address ' CXXFLAGS=' -g3
-fsanitize=address '
$ make

----------------------------------------------------------------------------
(asan report)

$ ./nasm -g -f dbg poc
=================================================================
==3551104==ERROR: AddressSanitizer: global-buffer-overflow on address
0x5588b06088f0 at pc 0x5588b0525260 bp 0x7fffe65c7ae0 sp 0x7fffe65c7ad0
READ of size 8 at 0x5588b06088f0 thread T0
    #0 0x5588b052525f in dbgdbg_typevalue output/outdbg.c:459
    #1 0x5588b04a37f7 in debug_set_db_type asm/assemble.c:1014
    #2 0x5588b04a43cf in insn_size asm/assemble.c:1137
    #3 0x5588b048f8be in process_insn asm/nasm.c:1598
    #4 0x5588b049033c in assemble_file asm/nasm.c:1737
    #5 0x5588b048b86d in main asm/nasm.c:717
    #6 0x7f409bee2082 in __libc_start_main ../csu/libc-start.c:308
    #7 0x5588b0488ccd in _start
(/home/a13579/SQ-Fuzz/mytest13579/nasm_cmplog_parfuzz/fuzz/output/slave2/queue_info/crashes/nasm_new/poc/nasm+0x111ccd)

0x5588b06088f0 is located 16 bytes to the right of global variable 'types'
defined in 'output/outdbg.c:411:27' (0x5588b06088a0) of size 64
0x5588b06088f0 is located 16 bytes to the left of global variable
'dbgdbg_pragma_list' defined in 'output/outdbg.c:524:37' (0x5588b0608900) of
size 32
SUMMARY: AddressSanitizer: global-buffer-overflow output/outdbg.c:459 in
dbgdbg_typevalue
Shadow bytes around the buggy address:
  0x0ab1960b90c0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ab1960b90d0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ab1960b90e0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ab1960b90f0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 f9 f9 f9
  0x0ab1960b9100: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9
=>0x0ab1960b9110: f9 f9 f9 f9 00 00 00 00 00 00 00 00 f9 f9[f9]f9
  0x0ab1960b9120: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0ab1960b9130: 00 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0ab1960b9140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ab1960b9150: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x0ab1960b9160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3551104==ABORTING


--------------------------------------------------------------------
(git log)

$ git log --oneline -1
a8ff6bf7 (HEAD -> master, origin/master, origin/HEAD) Merge pull request #37
from hjl-tools/hjl/dwarf32

-- 
You are receiving this mail because:
You are on the CC list for the bug.
You are watching all bug changes.