Heap out of bounds read in dex_parse_debug_item()

[fumfel]

Work environment

Questions	Answers
OS/arch/bits (mandatory)	Ubuntu 18.04 x64
File format of the file you reverse (mandatory)	DEX
Architecture/bits of the file (mandatory)	N/A
r2 -v full output, not truncated (mandatory)	radare2 2.9.0-git 19121 @ linux-x86-64 git.2.8.0-100-g6a5abe63e commit: 6a5abe6 build: 2018-08-15__17:05:54

Expected behavior

Disassembly of file or error message.

Actual behavior

Heap out of bounds read in ASAN build.

Steps to reproduce the behavior

• Download https://github.com/radare/radare2-regressions/pull/1429
• Run: r2 -A r2_hoobr_dex_parse_debug_item

Additional Logs, screenshots, source-code, configuration dump, ...

ASAN report:

==32646==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700000312e at pc 0x7f953b2be0ce bp 0x7ffd00064010 sp 0x7ffd00064008
READ of size 1 at 0x62700000312e thread T0
    #0 0x7f953b2be0cd in dex_parse_debug_item /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c
    #1 0x7f953b2be0cd in parse_dex_class_method /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1364
    #2 0x7f953b2b1797 in parse_class /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1563:7
    #3 0x7f953b2b1797 in dex_loadcode /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1662
    #4 0x7f953b2a83c7 in entries /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1800:3
    #5 0x7f953b22eb30 in r_bin_object_set_items /home/xubuntu/Desktop/radare2/libr/bin/obj.c:153:16
    #6 0x7f953b22e05b in r_bin_object_new /home/xubuntu/Desktop/radare2/libr/bin/obj.c:95:2
    #7 0x7f953b22497c in r_bin_file_new_from_bytes /home/xubuntu/Desktop/radare2/libr/bin/file.c:515:6
    #8 0x7f953b1fca1f in r_bin_load_io2 /home/xubuntu/Desktop/radare2/libr/bin/bin.c:486:13
    #9 0x7f953b1fbe75 in r_bin_load_io /home/xubuntu/Desktop/radare2/libr/bin/bin.c:42:12
    #10 0x7f953c6ec665 in r_core_file_do_load_for_io_plugin /home/xubuntu/Desktop/radare2/libr/core/file.c:385:7
    #11 0x7f953c6ec665 in r_core_bin_load /home/xubuntu/Desktop/radare2/libr/core/file.c:543
    #12 0x5614d8a8d615 in main /home/xubuntu/Desktop/radare2/binr/radare2/radare2.c:1079:15
    #13 0x7f9534c85b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #14 0x5614d898d089 in _start (/usr/local/bin/radare2+0x26089)

0x62700000312e is located 0 bytes to the right of 12334-byte region [0x627000000100,0x62700000312e)
allocated by thread T0 here:
    #0 0x5614d8a4e650 in calloc /home/xubuntu/Desktop/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:97
    #1 0x7f953b1fc2ab in r_bin_load_io2 /home/xubuntu/Desktop/radare2/libr/bin/bin.c:442:15

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c in dex_parse_debug_item
Shadow bytes around the buggy address:
  0x0c4e7fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff85e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff85f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff8600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4e7fff8610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4e7fff8620: 00 00 00 00 00[06]fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4e7fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==32646==ABORTING

[radare]

fixed in a PR, wiating for travis

…

On 15 Aug 2018, at 18:01, Kamil Frankowicz ***@***.***> wrote: Work environment Questions Answers OS/arch/bits (mandatory) Ubuntu 18.04 x64 File format of the file you reverse (mandatory) DEX Architecture/bits of the file (mandatory) N/A r2 -v full output, not truncated (mandatory) radare2 2.9.0-git 19121 @ linux-x86-64 git.2.8.0-100-g6a5abe63e commit: 6a5abe6 <6a5abe6> build: 2018-08-15__17:05:54 Expected behavior Disassembly of file or error message. Actual behavior Heap out of bounds read in ASAN build. Steps to reproduce the behavior Download radare/radare2-regressions#1429 <https://github.com/radare/radare2-regressions/pull/1429> Run: r2 -A r2_hoobr_dex_parse_debug_item Additional Logs, screenshots, source-code, configuration dump, ... ASAN report: ==32646==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700000312e at pc 0x7f953b2be0ce bp 0x7ffd00064010 sp 0x7ffd00064008 READ of size 1 at 0x62700000312e thread T0 #0 0x7f953b2be0cd in dex_parse_debug_item /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c #1 0x7f953b2be0cd in parse_dex_class_method /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1364 #2 0x7f953b2b1797 in parse_class /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1563:7 #3 0x7f953b2b1797 in dex_loadcode /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1662 #4 0x7f953b2a83c7 in entries /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c:1800:3 #5 0x7f953b22eb30 in r_bin_object_set_items /home/xubuntu/Desktop/radare2/libr/bin/obj.c:153:16 #6 0x7f953b22e05b in r_bin_object_new /home/xubuntu/Desktop/radare2/libr/bin/obj.c:95:2 #7 0x7f953b22497c in r_bin_file_new_from_bytes /home/xubuntu/Desktop/radare2/libr/bin/file.c:515:6 #8 0x7f953b1fca1f in r_bin_load_io2 /home/xubuntu/Desktop/radare2/libr/bin/bin.c:486:13 #9 0x7f953b1fbe75 in r_bin_load_io /home/xubuntu/Desktop/radare2/libr/bin/bin.c:42:12 #10 0x7f953c6ec665 in r_core_file_do_load_for_io_plugin /home/xubuntu/Desktop/radare2/libr/core/file.c:385:7 #11 0x7f953c6ec665 in r_core_bin_load /home/xubuntu/Desktop/radare2/libr/core/file.c:543 #12 0x5614d8a8d615 in main /home/xubuntu/Desktop/radare2/binr/radare2/radare2.c:1079:15 #13 0x7f9534c85b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96) #14 0x5614d898d089 in _start (/usr/local/bin/radare2+0x26089) 0x62700000312e is located 0 bytes to the right of 12334-byte region [0x627000000100,0x62700000312e) allocated by thread T0 here: #0 0x5614d8a4e650 in calloc /home/xubuntu/Desktop/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:97 #1 0x7f953b1fc2ab in r_bin_load_io2 /home/xubuntu/Desktop/radare2/libr/bin/bin.c:442:15 SUMMARY: AddressSanitizer: heap-buffer-overflow /home/xubuntu/Desktop/radare2/libr/..//libr/bin/p/bin_dex.c in dex_parse_debug_item Shadow bytes around the buggy address: 0x0c4e7fff85d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff85e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff85f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff8600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff8610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c4e7fff8620: 00 00 00 00 00[06]fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8630: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8640: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8650: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8660: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff8670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==32646==ABORTING — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11101>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-lii5dD0t20MtPwrIpvs0oKzlxAbmks5uREXbgaJpZM4V-XNJ>.