Null pointer dereference in buf_fprintf()

[fumfel]

Null pointer dereference in buf_fprintf()

Git HEAD: 7ce197e

Payload (bins/fuzzed/r2_nullptr_buf_fprintf) in https://github.com/radare/radare2-regressions/pull/949

To reproduce: r2 -A r2_nullptr_buf_fprintf

ASAN:

==21971==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000001fc (pc 0x56352d579122 bp 0x7fffec8494a0 sp 0x7fffec848bc8 T0)
==21971==The signal is caused by a READ memory access.
==21971==Hint: address points to the zero page.
    #0 0x56352d579121 in __sanitizer::internal_strlen(char const*) (/usr/local/bin/radare2+0xf5121)
    #1 0x56352d500ec0 in printf_common(void*, char const*, __va_list_tag*) (/usr/local/bin/radare2+0x7cec0)
    #2 0x56352d523fde in vsprintf (/usr/local/bin/radare2+0x9ffde)
    #3 0x7f0636d43507 in buf_fprintf XYZ/radare2/libr/asm/p/asm_lanai_gnu.c:59:2
    #4 0x7f0636d43ba3 in print_insn_lanai XYZ/radare2/libr/asm/p/../arch/lanai/gnu/lanai-dis.c:181:3
    #5 0x7f0636d43046 in disassemble XYZ/radare2/libr/asm/p/asm_lanai_gnu.c:86:13
    #6 0x7f0636dc660c in r_asm_disassemble XYZ/radare2/libr/asm/asm.c:398:10
    #7 0x7f063b1ca3de in r_core_anal_op XYZ/radare2/libr/core/canal.c:774:6
    #8 0x7f063b1d0652 in fcn_callconv XYZ/radare2/libr/core/canal.c:2314:9
    #9 0x7f063b1d4dc6 in r_core_anal_all XYZ/radare2/libr/core/canal.c:2893:5
    #10 0x7f063b10b7e3 in cmd_anal_all XYZ/radare2/libr/core/./cmd_anal.c:5471:4
    #11 0x7f063b0c6028 in cmd_anal XYZ/radare2/libr/core/./cmd_anal.c:5789:8
    #12 0x7f063b1c6845 in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:226:10
    #13 0x7f063b0fdb8d in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2296:12
    #14 0x7f063b0c2837 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1494:9
    #15 0x7f063b0bf456 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2904:9
    #16 0x56352d59b0f0 in main XYZ/radare2/binr/radare2/radare2.c
    #17 0x7f06342e34c9 in __libc_start_main (/usr/lib/libc.so.6+0x204c9)
    #18 0x56352d4a4d09 in _start (/usr/local/bin/radare2+0x20d09)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/local/bin/radare2+0xf5121) in __sanitizer::internal_strlen(char const*)
==21971==ABORTING

[radare]

This is a bug in the binutils fork of Google, not in r2 code. so i have fixed it, you should check that against their repo and report it accordingly. thanks

…

On 7 Aug 2017, at 09:36, Kamil Frankowicz ***@***.***> wrote: Null pointer dereference in buf_fprintf() Git HEAD: 7ce197e <7ce197e> Payload (bins/fuzzed/r2_nullptr_buf_fprintf) in radare/radare2-regressions#949 <https://github.com/radare/radare2-regressions/pull/949> To reproduce: r2 -A r2_nullptr_buf_fprintf ASAN: ==21971==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000001fc (pc 0x56352d579122 bp 0x7fffec8494a0 sp 0x7fffec848bc8 T0) ==21971==The signal is caused by a READ memory access. ==21971==Hint: address points to the zero page. #0 0x56352d579121 in __sanitizer::internal_strlen(char const*) (/usr/local/bin/radare2+0xf5121) #1 0x56352d500ec0 in printf_common(void*, char const*, __va_list_tag*) (/usr/local/bin/radare2+0x7cec0) #2 0x56352d523fde in vsprintf (/usr/local/bin/radare2+0x9ffde) #3 0x7f0636d43507 in buf_fprintf XYZ/radare2/libr/asm/p/asm_lanai_gnu.c:59:2 #4 0x7f0636d43ba3 in print_insn_lanai XYZ/radare2/libr/asm/p/../arch/lanai/gnu/lanai-dis.c:181:3 #5 0x7f0636d43046 in disassemble XYZ/radare2/libr/asm/p/asm_lanai_gnu.c:86:13 #6 0x7f0636dc660c in r_asm_disassemble XYZ/radare2/libr/asm/asm.c:398:10 #7 0x7f063b1ca3de in r_core_anal_op XYZ/radare2/libr/core/canal.c:774:6 #8 0x7f063b1d0652 in fcn_callconv XYZ/radare2/libr/core/canal.c:2314:9 #9 0x7f063b1d4dc6 in r_core_anal_all XYZ/radare2/libr/core/canal.c:2893:5 #10 0x7f063b10b7e3 in cmd_anal_all XYZ/radare2/libr/core/./cmd_anal.c:5471:4 #11 0x7f063b0c6028 in cmd_anal XYZ/radare2/libr/core/./cmd_anal.c:5789:8 #12 0x7f063b1c6845 in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:226:10 #13 0x7f063b0fdb8d in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2296:12 #14 0x7f063b0c2837 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1494:9 #15 0x7f063b0bf456 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2904:9 #16 0x56352d59b0f0 in main XYZ/radare2/binr/radare2/radare2.c #17 0x7f06342e34c9 in __libc_start_main (/usr/lib/libc.so.6+0x204c9) #18 0x56352d4a4d09 in _start (/usr/local/bin/radare2+0x20d09) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/usr/local/bin/radare2+0xf5121) in __sanitizer::internal_strlen(char const*) ==21971==ABORTING — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#8139>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-ln_mcr9rNyX1WTT0BUAPsTICnGBFks5sVr6LgaJpZM4OvFvc>.