{"id":1488,"date":"2017-03-20T11:52:45","date_gmt":"2017-03-20T09:52:45","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1488"},"modified":"2017-03-24T11:45:59","modified_gmt":"2017-03-24T09:45:59","slug":"libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/03\/20\/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c\/","title":{"rendered":"libpcre: two stack-based buffer overflow write in pcre32_copy_substring (pcre_get.c)"},"content":{"rendered":"

Description<\/strong>:
\nlibpcre<\/a> is a perl-compatible regular expression library.<\/p>\n

A fuzz on libpcre1 through the pcretest utility revealed two stack overflow write. Upstream says that these bugs are fixed by one of the previous commit. However I’m providing as usual the stacktrace and the reproducer, so if you are not running the latest upstream release, like happen on debian\/rhel based distros, you may want to check better the status of this bug.<\/p>\n

The complete ASan output:<\/p>\n

# pcretest -32 -d $FILE\r\n==29686==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f58f32026a0 at pc 0x7f58f6f90a24 bp 0x7ffea3aa3b30 sp 0x7ffea3aa3b28\r\nWRITE of size 4 at 0x7f58f32026a0 thread T0\r\n    #0 0x7f58f6f90a23 in pcre32_copy_substring \/tmp\/portage\/dev-libs\/libpcre-8.40\/work\/pcre-8.40\/pcre_get.c:358:15\r\n    #1 0x528220 in main \/tmp\/portage\/dev-libs\/libpcre-8.40\/work\/pcre-8.40\/pcretest.c:5333:13\r\n    #2 0x7f58f5ea778f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #3 0x41b438 in _init (\/usr\/bin\/pcretest+0x41b438)\r\n<\/font><\/pre>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00207-pcre-stackoverflow-pcre32_copy_substring<\/a>
\nCVE:<\/strong>
\nCVE-2017-7245<\/p>\n
# pcretest -32 -d $FILE\r\n==21399==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f83734026a0 at pc 0x0000004bd2ac bp 0x7ffdda673b30 sp 0x7ffdda6732e0\r\nWRITE of size 268 at 0x7f83734026a0 thread T0\r\n    #0 0x4bd2ab in __asan_memcpy \/tmp\/portage\/sys-devel\/llvm-3.9.1-r1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:413\r\n    #1 0x7f8377118925 in pcre32_copy_substring \/tmp\/portage\/dev-libs\/libpcre-8.40\/work\/pcre-8.40\/pcre_get.c:357:1\r\n    #2 0x528220 in main \/tmp\/portage\/dev-libs\/libpcre-8.40\/work\/pcre-8.40\/pcretest.c:5333:13\r\n    #3 0x7f837602f78f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #4 0x41b438 in _init (\/usr\/bin\/pcretest+0x41b438)\r\n<\/font><\/pre>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00209-pcre-stackoverflow2-read_capture_name32<\/a>
\nCVE:<\/strong>
\nCVE-2017-7246<\/p>\n
Affected version:<\/strong>
\n8.40<\/p>\n
Fixed version:<\/strong>
\n8.41 (not released atm)<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2017-02-24: bug discovered and reported to upstream
\n2017-03-20: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
libpcre: two stack-based buffer overflow write in pcre32_copy_substring (pcre_get.c)<\/a><\/p><\/blockquote>\n