{"id":1481,"date":"2017-03-14T16:29:17","date_gmt":"2017-03-14T14:29:17","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1481"},"modified":"2017-03-14T16:29:17","modified_gmt":"2017-03-14T14:29:17","slug":"libpcre-null-pointer-dereference-in-main-pcretest-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/14\/libpcre-null-pointer-dereference-in-main-pcretest-c\/","title":{"rendered":"libpcre: NULL pointer dereference in main (pcretest.c)"},"content":{"rendered":"

Description<\/strong>:
\nlibpcre<\/a> is a perl-compatible regular expression library.<\/p>\n

A fuzz on libpcre1 through the pcretest utility revealed a null pointer dereference in the utility itself. For the nature of the crash, it is not security relevant because the library is not affected but if you have a web application that calls directly the pcretest utility to parse untrusted data, then you are affected.
\nAlso, it is important share the details because some distros\/packagers may want to take the patch in their repository.<\/p>\n

The complete ASan output:<\/p>\n

# pcretest -16 -d $FILE\r\n==26399==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000052db1c bp 0x7ffc7de68070 sp 0x7ffc7de67ba0 T0)                                                                                                                                            \r\n==26399==The signal is caused by a READ memory access.                                                                                                                                                                                                                         \r\n==26399==Hint: address points to the zero page.                                                                                                                                                                                                                                \r\n    #0 0x52db1b in main \/tmp\/portage\/dev-libs\/libpcre-8.40\/work\/pcre-8.40\/pcretest.c:5083:25                                                                                                                                                                                   \r\n    #1 0x7f70603bc78f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289                                                                                                                                                     \r\n    #2 0x41b438 in _init (\/usr\/bin\/pcretest+0x41b438) \r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n8.40<\/p>\n
Fixed version:<\/strong>
\n8.41 (not released atm)<\/p>\n
Commit fix:<\/strong>
\nhttps:\/\/vcs.pcre.org\/pcre\/code\/trunk\/pcretest.c?r1=1685&r2=1686&sortby=date<\/a><\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nN\/A<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00195-pcre-nullptr-main<\/a><\/p>\n
Timeline:<\/strong>
\n2017-02-22: bug discovered and reported to upstream
\n2017-02-23: upstream released a patch
\n2017-03-14: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libpcre: NULL pointer dereference in main (pcretest.c)<\/a><\/p><\/blockquote>\n