Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allocator is out of memory in LIEF::MachO::BinaryParser::parse_dyldinfo_binds at MachO/BinaryParser.tcc:1365 #785

Closed
bladchan opened this issue Sep 13, 2022 · 0 comments
Assignees

Comments

@bladchan
Copy link

bladchan commented Sep 13, 2022

Describe the bug
A bad macho file which can lead to allocator is out of memory.
Poc here: poc4.zip

To Reproduce

  1. Build the whole project with ASAN
  2. Drive program (compile it with ASAN too):
// read_mecho.c
#include <LIEF/LIEF.hpp>

int main(int argc, char** argv){
	
	if(argc != 2) return 0;

	try {
	    std::unique_ptr<LIEF::MachO::FatBinary> macho = LIEF::MachO::Parser::parse(argv[1]);
	} catch (const LIEF::exception& err) {
	    std::cerr << err.what() << std::endl;
	}

	return 0;
}
  1. Run Poc:
$ ./read_macho ./poc4.bin

Expected behavior
Should avoid allocating an impractical size area.

Environment (please complete the following information):

  • System and Version : Ubuntu 20.04 + gcc 9.4.0
  • Target format Mach-O
  • LIEF commit version: 24935f6

Additional context
ASAN says:

ubuntu@ubuntu:~/test/LIEF/fuzz$ ./read_macho ./poc4.bin
nlist[0].str_idx seems corrupted (0xd0d0d0d0)
nlist[1].str_idx seems corrupted (0xd0d0d0d0)
......
nlist[354].str_idx seems corrupted (0xd0d0d0d0)
nlist[355].str_idx seems corrupted (0xd0d0d0d0)
Indirect symbol index is out of range (3503345872 vs max sym: 356)
=================================================================
==1128036==ERROR: AddressSanitizer: allocator is out of memory trying to allocate 0x371e1ee338 bytes
    #0 0x7f091fee6587 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:104
    #1 0x558554a9daac in allocate /usr/include/c++/9/ext/new_allocator.h:114
    #2 0x558554ad411e in boost::leaf::result<LIEF::ok_t> LIEF::MachO::BinaryParser::parse_dyldinfo_binds<LIEF::MachO::details::MachO32>() /home/chan/test/LIEF/src/MachO/BinaryParser.tcc:1365

==1128036==HINT: if you don't care about these errors you may set allocator_may_return_null=1
SUMMARY: AddressSanitizer: out-of-memory ../../../../src/libsanitizer/asan/asan_new_delete.cc:104 in operator new(unsigned long)
==1128036==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants