[Bastard-libdisasm] RE: overflow buffer bug

[Michael M. <ma...@ho...>]

take it easy with the CCs there fella ;)

haven't had time to reply to your earlier email, but here's the story:

* bastard code is no longer being maintained.

* libdisasm .21 [pre or something] is the latest, HOWEVER the
CVS version has some bug fixes.

* there is also a new version [rewrite of the decoding algo,
and support for the SSE2/3 crap] in a different dir in
CVS, but it has not been finished -- r/l concerns and all
that.

what's up with the mpatrol log? wouldn't valgrind be a better
way of finding where the bug is?

anyways, in the middle of something ... will get to your original
email later.

_m

>From: Kristis Makris <kri...@as...>
>To: bas...@li..., 
bas...@li...
>Subject: overflow buffer bug
>Date: Sun, 27 Feb 2005 12:21:06 -0700
>MIME-Version: 1.0
>Received: from sc8-sf-mx1.sourceforge.net ([66.35.250.206]) by 
MC8-F4.hotmail.com with Microsoft SMTPSVC(6.0.3790.211); Sun, 27 Feb 2005 
11:21:12 -0800
>Received: from mta6.srv.hcvlny.cv.net ([167.206.5.72])by 
sc8-sf-mx1.sourceforge.net with esmtp (Exim 4.41)id 1D5Tyb-0003Ll-5l; Sun, 
27 Feb 2005 11:21:13 -0800
>Received: from [192.168.0.30] (ool-44c7579f.dyn.optonline.net 
[68.199.87.159]) by mta6.srv.hcvlny.cv.net (iPlanet Messaging Server 5.2 
HotFix 1.25 (built Mar  3 2004)) with ESMTP id 
<0IC...@mt...>; Sun, 27 Feb 2005 14:21:07 
-0500 (EST)
>X-Message-Info: JGTYoYF78jFslrnrPyNKlf9gfY/RWzU2gbOuR0gSHgM=
>X-Mailer: Evolution 2.0.3
>X-Spam-Score: 0.0 (/)
>X-Spam-Report: Spam Filtering performed by sourceforge.net.See 
http://spamassassin.org/tag/ for more details.Report problems to 
http://sf.net/tracker/?func=add&group_id=1&atid=200001
>Return-Path: kri...@as...
>X-OriginalArrivalTime: 27 Feb 2005 19:21:13.0025 (UTC) 
FILETIME=[800A2B10:01C51D01]
>
>Hello,
>
>It appears that there is a buffer overflow problem in libdisasm. This
>was discovered using mpatrol and a random .bin file (attached). mpatrol
>reports (at the end of this email) that a memory allocation was given a
>pointer to a buffer that is corrupted before any data were written to
>it.
>
>This was produced using bastard_src-0.17.
>
>Is there a fix ? Is this project active or should I stop bothering ?
>
>Thanks,
>Kristis
>
>
>$ dd if=/dev/random of=test.bin bs=1 count=100 100+0 records in
>100+0 records out
>100 bytes transferred in 0.000747 seconds (133890 bytes/sec)
>
>
>$ mpatrol -g -i -C --dynamic --leak-table --alloc-byte=0x66
>--oflow-byte=0x79 --oflow-size=64  ./testdis test.bin
>File name: test.bin
>0       1C 14                   ;invariant bytes (signature)
>0       1C 14                               sbb %(null), $0x14
>2       31 A4 57 5B D7 18 E7                    ;invariant bytes
>(signature)
>2       31 A4 57 5B D7 18 E7                xor -18E728A5(%edi, %
>edx,02), %(null)
>9       2B 72 5A                        ;invariant bytes (signature)
>9       2B 72 5A                            sub %(null),  5A(%edx)
>C       94                      ;invariant bytes (signature)
>C       94                                  xchg        %(null), %(null)
>D       3F                      ;invariant bytes (signature)
>D       3F                                  aas
>E       66 EA F4 F4 F4 F4                       ;invariant bytes
>(signature)
>E       66 EA 9D 7D DF A5                   jmp *0xA5DF7D9D
>14      28 71 1E                        ;invariant bytes (signature)
>14      28 71 1E                            sub  1E(%ecx), %(null)
>17      DB 87 95 83 6B F5                       ;invariant bytes
>(signature)
>17      DB 87 95 83 6B F5                   fild        -0A947C6B(%edi)
>1D      63 E8                   ;invariant bytes (signature)
>1D      63 E8                               arpl        %(null), %(null)
>1F      D9                      ;invariant bytes (signature)
>1F      invalid opcode D9
>20      D9 93 58 0E 24 B7                       ;invariant bytes
>(signature)
>20      D9 93 58 0E 24 B7                   fst -48DBF1A8(%ebx)
>26      44                      ;invariant bytes (signature)
>26      44                                  inc %(null)
>27      DF                      ;invariant bytes (signature)
>27      invalid opcode DF
>28      08 71 FF                        ;invariant bytes (signature)
>28      08 71 FF                            or  -01(%ecx), %(null)
>2B      89 4B 90                        ;invariant bytes (signature)
>2B      89 4B 90                            mov -70(%ebx), %(null)
>2E      7A 18                   ;invariant bytes (signature)
>2E      7A 18                               jpe +0x18
>30      15 F4 F4 F4 F4                  ;invariant bytes (signature)
>30      15 4C 14 9A 96                      adc %(null), $-0x969A144C
>35      A7                      ;invariant bytes (signature)
>35      A7                                  cmpsd       %(null), %(null)
>36      7C E4                   ;invariant bytes (signature)
>36      7C E4                               jl  +0xE4
>38      71 88                   ;invariant bytes (signature)
>38      71 88                               jno +0x88
>3A      FB                      ;invariant bytes (signature)
>3A      FB                                  sti
>3B      6B B0 83 A0 7D 20 90                    ;invariant bytes
>(signature)
>3B      6B B0 83 A0 7D 20 90                imul        %(null),
>207DA083(%eax), $-0xFFFFFF90
>42      50                      ;invariant bytes (signature)
>42      50                                  push        %(null)
>43      E9 F4 F4 F4 F4                  ;invariant bytes (signature)
>43      E9 D6 77 A4 9B                      jmp +0x9BA477D6
>48      F9                      ;invariant bytes (signature)
>48      F9                                  stc
>49      5B                      ;invariant bytes (signature)
>49      5B                                  pop %(null)
>4A      AA                      ;invariant bytes (signature)
>4A      AA                                  stosb       %(null), %(null)
>4B      32 FF                   ;invariant bytes (signature)
>4B      32 FF                               xor %(null), %(null)
>4D      C9                      ;invariant bytes (signature)
>4D      C9                                  leave
>4E      51                      ;invariant bytes (signature)
>4E      51                                  push        %(null)
>4F      49                      ;invariant bytes (signature)
>4F      49                                  dec %(null)
>50      10 7A 0E                        ;invariant bytes (signature)
>50      10 7A 0E                            adc  0E(%edx), %(null)
>53      66 3F                   ;invariant bytes (signature)
>53      66 3F                               aas
>55      2C 64                   ;invariant bytes (signature)
>55      2C 64                               sub %(null), $0x64
>57      E4 36                   ;invariant bytes (signature)
>57      E4 36                               in  %(null), $0x36
>59      04 68                   ;invariant bytes (signature)
>59      04 68                               add %(null), $0x68
>5B      25 F4 F4 F4 F4                  ;invariant bytes (signature)
>5B      25 05 4B B1 A2                      and %(null), $-0xA2B14B05
>60      A9 F4 F4 F4 F4                  ;invariant bytes (signature)
>60      A9 48 A4 5F 00                      test        %(null),
>$0x5FA448
>(2148)12:11:46[mkgnu@syd:~/incoming/bastard_src-0.17/src/arch/i386/libdisasm]$ 
more mpatrol.21399.log
>@(#) mpatrol 1.4.8 (02/01/08)
>Copyright (C) 1997-2002 Graeme S. Roy
>
>This is free software, and you are welcome to redistribute it under
>certain
>conditions; see the GNU Library General Public License for details.
>
>For the latest mpatrol release and documentation,
>visit http://www.cbmamiga.demon.co.uk/mpatrol.
>
>operating system:       UNIX
>system variant:         Linux
>processor architecture: Intel 80x86
>processor word size:    32-bit
>object file format:     ELF32
>dynamic linker type:    SVR4
>
>Log file generated on Sun Feb 27 12:11:46 2005
>
>read 77 symbols from ./testdis
>
>LOG: check () [-|-|-]
>         0x400457FE ???
>         0x4000C4F6 ???
>         0x40095A52 ???
>         0x4007FDCE ???
>         0x08048661 _start+33
>
>system page size:  4096 bytes
>default alignment: 4 bytes
>overflow size:     64 bytes
>overflow byte:     0x79
>allocation byte:   0x66
>free byte:         0x55
>allocation stop:   0
>reallocation stop: 0
>free stop:         0
>unfreed abort:     0
>small boundary:    32 bytes
>medium boundary:   256 bytes
>large boundary:    2048 bytes
>lower check range: 0
>upper check range: 0
>check frequency:   1
>failure frequency: 0
>failure seed:      1109531506
>prologue function: <unset>
>epilogue function: <unset>
>handler function:  <unset>
>log file:          mpatrol.21399.log
>profiling file:    mpatrol.21399.out
>tracing file:      mpatrol.21399.trace
>program filename:  ./testdis
>symbols read:      77
>autosave count:    0
>freed queue size:  0
>allocation count:  29
>allocation peak:   18 (6371 bytes)
>allocation limit:  0 bytes
>allocated blocks:  15 (755 bytes)
>marked blocks:     0 (0 bytes)
>freed blocks:      0 (0 bytes)
>free blocks:       9 (9613 bytes)
>internal blocks:   8 (131072 bytes)
>total heap usage:  143360 bytes
>total compared:    0 bytes
>total located:     0 bytes
>total copied:      1547 bytes
>total set:         6860 bytes
>total warnings:    0
>total errors:      0
>
>ERROR: [ALLOVF]: allocation 0x08061080 has a corrupted overflow buffer
>at 0x080610A4
>         0x0806109C  79797979 79797979 00000000 79797979
>yyyyyyyy....yyyy
>         0x080610AC  79797979 79797979 79797979 79797979
>yyyyyyyyyyyyyyyy
>         0x080610BC  79797979 79797979 79797979 79797979
>yyyyyyyyyyyyyyyy
>         0x080610CC  79797979 79797979 79797979 79797979
>yyyyyyyyyyyyyyyy
>
>     0x08061080 (28 bytes) {calloc:15:0} [-|-|-]
>         0x08049C1C x86_old_disasm_addr+496
>         0x080488A0 main+400
>         0x4007FDC6 ???
>         0x08048661 _start+33
>
>
><< test.bin >>