Bug #10957
closed
seg fault in ruby_yyparse () at parse.y:2105 (null ptr / stack overflow)
Description
Built ruby 2.3.0dev (2015-03-07 trunk 49885) [x86_64-linux] from git source earlier this evening. This bug was found with american fuzzy lop (http://lcamtuf.coredump.cx/afl) and was compiled as follows:
CC=afl-gcc ./configure && AFL_HARDEN=1 make -j8 && make install
Valgrind:
==41211== Invalid write of size 1
==41211== at 0x827873: reserve_stack (thread_pthread.c:684)
==41211== by 0x842871: ruby_init_stack (thread_pthread.c:713)
==41211== by 0x1337E8: main (main.c:34)
==41211== Address 0x7fe8010e0 is on thread 1's stack
==41211==
==41211== Stack overflow in thread 1: can't grow stack to 0x7fe8010e0
==41211==
==41211== Process terminating with default action of signal 11 (SIGSEGV)
==41211== Access not within mapped region at address 0x7FE8010E0
==41211== at 0x827873: reserve_stack (thread_pthread.c:684)
==41211== If you believe this happened as a result of a stack
==41211== overflow in your program's main thread (unlikely but
==41211== possible), you can try to increase the size of the
==41211== main thread stack using the --main-stacksize= flag.
==41211== The main thread stack size used in this run was 8388608.
==41211== Stack overflow in thread 1: can't grow stack to 0x7fe8010d9
==41211==
==41211== Process terminating with default action of signal 11 (SIGSEGV)
==41211== Access not within mapped region at address 0x7FE8010D9
==41211== at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58)
==41211== If you believe this happened as a result of a stack
==41211== overflow in your program's main thread (unlikely but
==41211== possible), you can try to increase the size of the
==41211== main thread stack using the --main-stacksize= flag.
==41211== The main thread stack size used in this run was 8388608.
Segmentation fault
GDB:
gdb-peda$ file ruby
gdb-peda$ set args test00-min
gdb-peda$ r
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff6c00700 (LWP 48391)]
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x555556679f20 --> 0xd71c
RBX: 0xd1
RCX: 0x0
RDX: 0x1
RSI: 0x0
RDI: 0x0
RBP: 0xd71c
RSP: 0x7fffffffbe70 --> 0x7fff000000d1
RIP: 0x555555f312f8 (<ruby_yyparse+148344>: mov r11,QWORD PTR [rsi])
R8 : 0x5555566651c0 --> 0x555556678000 (0x00005555566651c0)
R9 : 0x0
R10: 0x3900 ('')
R11: 0xfffffffffffa360a
R12: 0x555556679f20 --> 0xd71c
R13: 0x7fffffffc120 --> 0x555556679f48 --> 0xb91c
R14: 0x7fffffffbf6c --> 0x55befb3e026f021d
R15: 0x555556402060 --> 0x0
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x555555f312ee <ruby_yyparse+148334>: mov r12,rax
0x555555f312f1 <ruby_yyparse+148337>: mov QWORD PTR [rax],rbp
0x555555f312f4 <ruby_yyparse+148340>: mov rsi,QWORD PTR [r13-0x10]
=> 0x555555f312f8 <ruby_yyparse+148344>: mov r11,QWORD PTR [rsi]
0x555555f312fb <ruby_yyparse+148347>: and r11d,0x7f00
0x555555f31302 <ruby_yyparse+148354>: cmp r11,0x3900
0x555555f31309 <ruby_yyparse+148361>: jne 0x555555f0ee47 <ruby_yyparse+7879>
0x555555f3130f <ruby_yyparse+148367>: nop
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffbe70 --> 0x7fff000000d1
0008| 0x7fffffffbe78 --> 0x555500000000 ('')
0016| 0x7fffffffbe80 --> 0x7fffffffbf60 --> 0xe6004c00020000
0024| 0x7fffffffbe88 --> 0xd1
0032| 0x7fffffffbe90 --> 0xc8
0040| 0x7fffffffbe98 --> 0x0
0048| 0x7fffffffbea0 --> 0x7fffffffc0f0 --> 0x88cf9f52f8c4423
0056| 0x7fffffffbea8 --> 0x7fffffffbf60 --> 0xe6004c00020000
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555555f312f8 in ruby_yyparse () at parse.y:2105
2105 if (nd_type($1) == NODE_LIT && FIXNUM_P($1->nd_lit) &&
gdb-peda$ exploit
Description: Access violation near NULL on source operand
Short description: SourceAvNearNull (16/22)
Hash: 8e697703610f21a0a2aaec98723ec089.0b098a66d2dd0257594a0e5fb055f0de
Exploitability Classification: PROBABLY_NOT_EXPLOITABLE
Explanation: The target crashed on an access violation at an address matching the source operand of the current instruction. This likely indicates a read access violation, which may mean the application crashed on a simple NULL dereference to data structure that has no immediate effect on control of the processor.
Other tags: AccessViolation (21/22)
Hexdump of the 7-byte test case:
0000000 2070 2928 2e2e 0030
0000007
System Info: Debian 7, Kernel 3.2.65-1+deb7u1 x86_64, GCC 4.9.2, libc 2.13-38+deb7u8
Files
Updated by nobu (Nobuyoshi Nakada) over 9 years ago
- Status changed from Open to Closed
- % Done changed from 0 to 100
Applied in changeset r49964.
parse.y: empty paren
- parse.y (primary): empty parentheses at cmdarg can be null.
[ruby-core:68477] [Bug #10957]
Updated by nobu (Nobuyoshi Nakada) over 9 years ago
- Description updated (diff)
- Backport changed from 2.0.0: UNKNOWN, 2.1: UNKNOWN, 2.2: UNKNOWN to 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: REQUIRED
Updated by nagachika (Tomoyuki Chikanaga) over 9 years ago
- Has duplicate Bug #10976: SEGV: `p ()...0` added
Updated by nagachika (Tomoyuki Chikanaga) over 9 years ago
- Backport changed from 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: REQUIRED to 2.0.0: REQUIRED, 2.1: DONE, 2.2: REQUIRED
Backported into ruby_2_1 branch at r50128.
Updated by geeknik (Brian Carpenter) over 9 years ago
This bug is still present in ruby 2.3.0dev (2015-04-11 trunk 50237) [x86_64-linux]. The test case in this instance is 6 bytes. Running ruby -e '0..%w.' should trigger it.
test00-min:1: unterminated string meets end of file
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x555556651d18 --> 0xd61b
RBX: 0x0
RCX: 0x0
RDX: 0x1
RSI: 0x555556651de0 --> 0xb91b
RDI: 0x561b
RBP: 0xd61b
RSP: 0x7fffffffbe70 --> 0x7fff000000d1
RIP: 0x555555f071b4 (<ruby_yyparse+148564>: mov rdi,QWORD PTR [rbx])
R8 : 0x55555663ba00 --> 0x555556650000 (0x000055555663ba00)
R9 : 0x3900 ('')
R10: 0x3900 ('')
R11: 0x5eb
R12: 0x555556651d18 --> 0xd61b
R13: 0x7fffffffc110 --> 0x0
R14: 0x7fffffffbf68 --> 0x1ec0128021d
R15: 0x5555563d8130 --> 0x0
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x555555f071a4 <ruby_yyparse+148548>: mov rdx,QWORD PTR [rsp]
0x555555f071a8 <ruby_yyparse+148552>: lea rsp,[rsp+0x98]
0x555555f071b0 <ruby_yyparse+148560>: mov rbx,QWORD PTR [r13+0x0]
=> 0x555555f071b4 <ruby_yyparse+148564>: mov rdi,QWORD PTR [rbx]
0x555555f071b7 <ruby_yyparse+148567>: and edi,0x7f00
0x555555f071bd <ruby_yyparse+148573>: cmp rdi,0x3900
0x555555f071c4 <ruby_yyparse+148580>: jne 0x555555ee4c27 <ruby_yyparse+7879>
0x555555f071ca <ruby_yyparse+148586>: xchg ax,ax
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffbe70 --> 0x7fff000000d1
0008| 0x7fffffffbe78 --> 0x0
0016| 0x7fffffffbe80 --> 0x7fffffffbf60 --> 0x155005400020000
0024| 0x7fffffffbe88 --> 0xd1
0032| 0x7fffffffbe90 --> 0xc8
0040| 0x7fffffffbe98 --> 0x555500000000 ('')
0048| 0x7fffffffbea0 --> 0x7fffffffc0f0 --> 0x555500000000 ('')
0056| 0x7fffffffbea8 --> 0x7fffffffbf60 --> 0x155005400020000
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x0000555555f071b4 in ruby_yyparse () at parse.y:2106
2106 nd_type($3) == NODE_LIT && FIXNUM_P($3->nd_lit)) {
==28563== Invalid write of size 1
==28563== at 0x827873: reserve_stack (thread_pthread.c:684)
==28563== by 0x842871: ruby_init_stack (thread_pthread.c:713)
==28563== by 0x1337E8: main (main.c:34)
==28563== Address 0x7fe8010e0 is on thread 1's stack
==28563==
==28563== Stack overflow in thread 1: can't grow stack to 0x7fe8010e0
==28563==
==28563== Process terminating with default action of signal 11 (SIGSEGV)
==28563== Access not within mapped region at address 0x7FE8010E0
==28563== at 0x827873: reserve_stack (thread_pthread.c:684)
==28563== If you believe this happened as a result of a stack
==28563== overflow in your program's main thread (unlikely but
==28563== possible), you can try to increase the size of the
==28563== main thread stack using the --main-stacksize= flag.
==28563== The main thread stack size used in this run was 8388608.
==28563== Stack overflow in thread 1: can't grow stack to 0x7fe8010d9
==28563==
==28563== Process terminating with default action of signal 11 (SIGSEGV)
==28563== Access not within mapped region at address 0x7FE8010D9
==28563== at 0x4A226E0: _vgnU_freeres (vg_preloaded.c:58)
==28563== If you believe this happened as a result of a stack
==28563== overflow in your program's main thread (unlikely but
==28563== possible), you can try to increase the size of the
==28563== main thread stack using the --main-stacksize= flag.
==28563== The main thread stack size used in this run was 8388608.
Segmentation fault
Updated by nagachika (Tomoyuki Chikanaga) over 9 years ago
- Backport changed from 2.0.0: REQUIRED, 2.1: DONE, 2.2: REQUIRED to 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: REQUIRED
It seems that r50265 is necessary for ruby_2_1.
Updated by nagachika (Tomoyuki Chikanaga) over 9 years ago
- Backport changed from 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: REQUIRED to 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: DONE
r49964 and r50265 were backported into ruby_2_2 branch at r50277.
Updated by usa (Usaku NAKAMURA) over 9 years ago
- Backport changed from 2.0.0: REQUIRED, 2.1: REQUIRED, 2.2: DONE to 2.0.0: REQUIRED, 2.1: DONE, 2.2: DONE
ruby_2_1 r50283 merged revision(s) 50265.