{"id":766,"date":"2016-10-18T17:01:10","date_gmt":"2016-10-18T15:01:10","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=766"},"modified":"2016-10-19T09:32:51","modified_gmt":"2016-10-19T07:32:51","slug":"snzip-memory-allocation-failure-in-work_buffer_resize-snzip-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/10\/18\/snzip-memory-allocation-failure-in-work_buffer_resize-snzip-c\/","title":{"rendered":"snzip: memory allocation failure in work_buffer_resize (snzip.c)"},"content":{"rendered":"

Description<\/strong>:
\nsnzip<\/a> is a compression\/decompression tool based on snappy.<\/p>\n

A fuzzing revealed a memory allocation failure.<\/p>\n

The complete ASan output:<\/p>\n

# snzip -d $FILE\r\n\u0224\ufffd==12351==WARNING: AddressSanitizer failed to allocate 0xffffffffc8617364 bytes\r\n==12351==AddressSanitizer's allocator is terminating the process instead of returning 0\r\n==12351==If you don't like this behavior set allocator_may_return_null=1\r\n==12351==AddressSanitizer CHECK failed: \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/sanitizer_common\/sanitizer_allocator.cc:147 \"((0)) != (0)\" (0x0, 0x0)\r\n    #0 0x4ca7ed in AsanCheckFailed \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/asan_rtl.cc:67                                                                                                                                   \r\n    #1 0x4d1323 in __sanitizer::CheckFailed(char const*, int, char const*, unsigned long long, unsigned long long) \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/sanitizer_common\/sanitizer_common.cc:159                              \r\n    #2 0x4cf076 in __sanitizer::ReportAllocatorCannotReturnNull() \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/sanitizer_common\/sanitizer_allocator.cc:147                                                                            \r\n    #3 0x424896 in __sanitizer::CombinedAllocator<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback>, __sanitizer::SizeClassAllocatorLocalCache<__sanitizer::SizeClassAllocator64<105553116266496ul, 4398046511104ul, 0ul, __sanitizer::SizeClassMap, __asan::AsanMapUnmapCallback> >, __sanitizer::LargeMmapAllocator >::ReturnNullOrDie() \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/..\/sanitizer_common\/sanitizer_allocator.h:1317                                                                                                                                                                                                   \r\n    #4 0x424896 in __asan::Allocator::Allocate(unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType, bool) \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:359                       \r\n    #5 0x4205bd in __asan::Allocator::Reallocate(void*, unsigned long, __sanitizer::BufferedStackTrace*) \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:539                                                      \r\n    #6 0x4205bd in __asan::asan_realloc(void*, unsigned long, __sanitizer::BufferedStackTrace*) \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/asan_allocator.cc:732                                                               \r\n    #7 0x4c1231 in realloc \/var\/tmp\/portage\/sys-devel\/llvm-3.8.1-r2\/work\/llvm-3.8.1.src\/projects\/compiler-rt\/lib\/asan\/asan_malloc_linux.cc:79                                                                                                                                  \r\n    #8 0x4fe72c in work_buffer_resize \/tmp\/portage\/app-arch\/snzip-1.0.3\/work\/snzip-1.0.3\/snzip.c:584:13                                                                                                                                                                        \r\n    #9 0x51667b in snappy_java_uncompress \/tmp\/portage\/app-arch\/snzip-1.0.3\/work\/snzip-1.0.3\/snappy-java-format.c:193:7                                                                                                                                                        \r\n    #10 0x4f68ea in main \/tmp\/portage\/app-arch\/snzip-1.0.3\/work\/snzip-1.0.3\/snzip.c:401:11                                                                                                                                                                                     \r\n    #11 0x7fcbabbd261f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289                                                                                                                                                       \r\n    #12 0x419988 in _init (\/usr\/bin\/snzip+0x419988)\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n1.0.3<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
Timeline:<\/strong>
\n2016-10-13: bug discovered
\n2016-10-13: bug reported to upstream
\n2016-10-18: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.<\/p>\n
Permalink:<\/strong><\/p>\n
snzip: memory allocation failure in work_buffer_resize (snzip.c)<\/a><\/p><\/blockquote>\n