{"id":1761,"date":"2017-05-07T20:09:25","date_gmt":"2017-05-07T18:09:25","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1761"},"modified":"2017-05-09T09:59:27","modified_gmt":"2017-05-09T07:59:27","slug":"lrzip-null-pointer-dereference-in-bufreadget-libzpaq-h","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/05\/07\/lrzip-null-pointer-dereference-in-bufreadget-libzpaq-h\/","title":{"rendered":"lrzip: NULL pointer dereference in bufRead::get (libzpaq.h)"},"content":{"rendered":"

Description<\/strong>:
\nlrzip<\/a> is a compression utility that excels at compressing large files.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# lrzip -t $FILE\r\n==24966==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005e7caa bp 0x7f7c755a58d0 sp 0x7f7c755a5870 T2)                                                                               \r\n==24966==The signal is caused by a READ memory access.                                                                                                                                                            \r\n==24966==Hint: address points to the zero page.                                                                                                                                                                   \r\n    #0 0x5e7ca9 in bufRead::get() \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/libzpaq\/libzpaq.h:485:24                                                                                                     \r\n    #1 0x5856f1 in libzpaq::Decompresser::findBlock(double*) \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/libzpaq\/libzpaq.cpp:1236:21                                                                       \r\n    #2 0x55f79a in libzpaq::decompress(libzpaq::Reader*, libzpaq::Writer*) \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/libzpaq\/libzpaq.cpp:1363:12                                                         \r\n    #3 0x55f4e2 in zpaq_decompress \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/libzpaq\/libzpaq.h:538:2                                                                                                     \r\n    #4 0x54b3a4 in zpaq_decompress_buf \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/stream.c:453:2                                                                                                          \r\n    #5 0x54b3a4 in ucompthread \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/stream.c:1534                                                                                                                   \r\n    #6 0x7f81b7a434a3 in start_thread \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/nptl\/pthread_create.c:333\r\n    #7 0x7f81b6d6e66c in clone \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/misc\/..\/sysdeps\/unix\/sysv\/linux\/x86_64\/clone.S:109\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/libzpaq\/libzpaq.h:485:24 in bufRead::get()\r\nThread T2 created by T0 here:\r\n    #0 0x42d49d in pthread_create \/tmp\/portage\/sys-devel\/llvm-3.9.1-r1\/work\/llvm-3.9.1.src\/projects\/compiler-rt\/lib\/asan\/asan_interceptors.cc:245\r\n    #1 0x53e70f in create_pthread \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/stream.c:133:6\r\n    #2 0x53e70f in fill_buffer \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/stream.c:1673\r\n    #3 0x53e70f in read_stream \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/stream.c:1755\r\n    #4 0x531075 in unzip_literal \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/runzip.c:162:16\r\n    #5 0x531075 in runzip_chunk \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/runzip.c:320\r\n    #6 0x531075 in runzip_fd \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/runzip.c:382\r\n    #7 0x519b41 in decompress_file \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/lrzip.c:826:6\r\n    #8 0x511074 in main \/tmp\/portage\/app-arch\/lrzip-0.631\/work\/lrzip-0.631\/main.c:669:4\r\n    #9 0x7f81b6ca778f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n\r\n==24966==ABORTING\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.631<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-8847<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00229-lrzip-nullptr-bufRead-get<\/a><\/p>\n
Timeline:<\/strong>
\n2017-03-24: bug discovered and reported to upstream
\n2017-05-07: blog post about the issue
\n2017-05-08: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
lrzip: NULL pointer dereference in bufRead::get (libzpaq.h)<\/a><\/p><\/blockquote>\n