{"id":1828,"date":"2017-05-24T15:24:11","date_gmt":"2017-05-24T13:24:11","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=1828"},"modified":"2017-06-07T14:40:48","modified_gmt":"2017-06-07T12:40:48","slug":"ytnef-memory-allocation-failure-in-tneffillmapi-ytnef-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2017\/05\/24\/ytnef-memory-allocation-failure-in-tneffillmapi-ytnef-c\/","title":{"rendered":"ytnef: memory allocation failure in TNEFFillMapi (ytnef.c)"},"content":{"rendered":"

Description<\/strong>:
\nytnef<\/a> is Yeraze’s TNEF Stream Reader – for winmail.dat files.<\/p>\n

The complete ASan output of the issue:<\/p>\n

# ytnefprint $FILE\r\n==11998==AddressSanitizer CHECK failed: \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/sanitizer_common\/sanitizer_common.cc:120 \"((0 && \"unable to mmap\")) != (0)\" (0x0, 0x0)\r\n    #0 0x4d95cf in __asan::AsanCheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_rtl.cc:69\r\n    #1 0x4f4335 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/sanitizer_common\/sanitizer_termination.cc:79\r\n    #2 0x4e3962 in __sanitizer::ReportMmapFailureAndDie(unsigned long, char const*, char const*, int, bool) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/sanitizer_common\/sanitizer_common.cc:120\r\n    #3 0x4ed265 in __sanitizer::MmapOrDie(unsigned long, char const*, bool) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/sanitizer_common\/sanitizer_posix.cc:132\r\n    #4 0x424c6a in __sanitizer::LargeMmapAllocator::Allocate(__sanitizer::AllocatorStats*, unsigned long, unsigned long) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator_secondary.h:41\r\n    #5 0x424c6a in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64 >, __sanitizer::LargeMmapAllocator >::Allocate(__sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64 >*, unsigned long, unsigned long, bool, bool) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator_combined.h:70\r\n    #6 0x424c6a in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_allocator.cc:407\r\n    #7 0x41f1fb in __asan::Allocator::Calloc(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_allocator.cc:605\r\n    #8 0x41f1fb in __asan::asan_calloc(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*) \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_allocator.cc:786\r\n    #9 0x4cf7ba in calloc \/tmp\/portage\/sys-libs\/compiler-rt-sanitizers-4.0.0\/work\/compiler-rt-4.0.0.src\/lib\/asan\/asan_malloc_linux.cc:75\r\n    #10 0x7fe45c3e4e53 in TNEFFillMapi \/tmp\/ytnef-1.9.2\/lib\/ytnef.c:424:19\r\n    #11 0x7fe45c3e1384 in TNEFMapiProperties \/tmp\/ytnef-1.9.2\/lib\/ytnef.c:396:7\r\n    #12 0x7fe45c3f6b47 in TNEFParse \/tmp\/ytnef-1.9.2\/lib\/ytnef.c:1184:15\r\n    #13 0x7fe45c3f59d3 in TNEFParseFile \/tmp\/ytnef-1.9.2\/lib\/ytnef.c:1042:10\r\n    #14 0x508814 in main \/tmp\/ytnef-1.9.2\/ytnefprint\/main.c:80:9\r\n    #15 0x7fe45b50b78f in __libc_start_main \/tmp\/portage\/sys-libs\/glibc-2.23-r3\/work\/glibc-2.23\/csu\/..\/csu\/libc-start.c:289\r\n    #16 0x419c38 in _start (\/usr\/bin\/ytnefprint+0x419c38)\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.9.2<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nCVE-2017-9473<\/p>\n
Reproducer:<\/strong>
\nhttps:\/\/github.com\/asarubbo\/poc\/blob\/master\/00246-ytnef-memallocfailures<\/a><\/p>\n
Timeline:<\/strong>
\n2017-03-27: bug discovered and reported to upstream
\n2017-05-24: blog post about the issue
\n2017-06-07: CVE assigned<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
ytnef: memory allocation failure in TNEFFillMapi (ytnef.c)<\/a><\/p><\/blockquote>\n