#587 Use-after-free (heap) in the end_scope_of_program_name() function

[Frederic Cambus]

Hi,

While fuzzing gnucobol with Honggfuzz, I found a heap use-after-free in the end_scope_of_program_name() function, in cobc/parser.y.

Attaching a reproducer, issue can be reproduced by running:

cobc test06.cob

I have been able to reproduce this issue on both GnuCOBOL 2.2 and with the latest SVN trunk version.

=================================================================
==31438==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000011d0 at pc 0x0000005ae861 bp 0x7ffdc231a170 sp 0x7ffdc231a168
READ of size 8 at 0x6070000011d0 thread T0
    #0 0x5ae860 in end_scope_of_program_name /home/fcambus/open-cobol-code/cobc/parser.y:1112:23
    #1 0x5a6e52 in clean_up_program /home/fcambus/open-cobol-code/cobc/parser.y:1256:2
    #2 0x551cba in yyparse /home/fcambus/open-cobol-code/cobc/parser.y:3210:2
    #3 0x51db41 in process_translate /home/fcambus/open-cobol-code/cobc/cobc.c:6959:8
    #4 0x5016d7 in process_file /home/fcambus/open-cobol-code/cobc/cobc.c:8059:19
    #5 0x4faaff in main /home/fcambus/open-cobol-code/cobc/cobc.c:8241:12
    #6 0x7f01a1471b6a in __libc_start_main /build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:308:16
    #7 0x41c559 in _start (/usr/local/bin/cobc+0x41c559)

0x6070000011d0 is located 48 bytes inside of 80-byte region [0x6070000011a0,0x6070000011f0)
freed by thread T0 here:
    #0 0x4c7b82 in free /build/llvm-toolchain-8-F3l7P1/llvm-toolchain-8-8/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3
    #1 0x4f7b26 in cobc_free /home/fcambus/open-cobol-code/cobc/cobc.c:992:2
    #2 0x4f8af2 in cobc_parse_free /home/fcambus/open-cobol-code/cobc/cobc.c:1302:2
    #3 0x5aec9b in remove_program_name /home/fcambus/open-cobol-code/cobc/parser.y:1065:2
    #4 0x5ae826 in end_scope_of_program_name /home/fcambus/open-cobol-code/cobc/parser.y:1111:5
    #5 0x5a6e52 in clean_up_program /home/fcambus/open-cobol-code/cobc/parser.y:1256:2
    #6 0x551cba in yyparse /home/fcambus/open-cobol-code/cobc/parser.y:3210:2
    #7 0x51db41 in process_translate /home/fcambus/open-cobol-code/cobc/cobc.c:6959:8
    #8 0x5016d7 in process_file /home/fcambus/open-cobol-code/cobc/cobc.c:8059:19
    #9 0x4faaff in main /home/fcambus/open-cobol-code/cobc/cobc.c:8241:12
    #10 0x7f01a1471b6a in __libc_start_main /build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:308:16

previously allocated by thread T0 here:
    #0 0x4c80fa in calloc /build/llvm-toolchain-8-F3l7P1/llvm-toolchain-8-8/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:155:3
    #1 0x4f83b8 in cobc_parse_malloc /home/fcambus/open-cobol-code/cobc/cobc.c:1195:6
    #2 0x5ee3ba in make_tree /home/fcambus/open-cobol-code/cobc/tree.c:412:6
    #3 0x5f5879 in cb_build_list /home/fcambus/open-cobol-code/cobc/tree.c:1813:6
    #4 0x5f613a in cb_list_add /home/fcambus/open-cobol-code/cobc/tree.c:1840:28
    #5 0x5af2bb in begin_scope_of_program_name /home/fcambus/open-cobol-code/cobc/parser.y:1053:22
    #6 0x5a77e6 in setup_program /home/fcambus/open-cobol-code/cobc/parser.y:1213:2
    #7 0x551e43 in yyparse /home/fcambus/open-cobol-code/cobc/parser.y:3287:6
    #8 0x51db41 in process_translate /home/fcambus/open-cobol-code/cobc/cobc.c:6959:8
    #9 0x5016d7 in process_file /home/fcambus/open-cobol-code/cobc/cobc.c:8059:19
    #10 0x4faaff in main /home/fcambus/open-cobol-code/cobc/cobc.c:8241:12
    #11 0x7f01a1471b6a in __libc_start_main /build/glibc-KRRWSm/glibc-2.29/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-use-after-free /home/fcambus/open-cobol-code/cobc/parser.y:1112:23 in end_scope_of_program_name
Shadow bytes around the buggy address:
  0x0c0e7fff81e0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 00 00
  0x0c0e7fff81f0: 00 00 00 00 00 00 00 00 fa fa fa fa 00 00 00 00
  0x0c0e7fff8200: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00
  0x0c0e7fff8210: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c0e7fff8220: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 02 fa
=>0x0c0e7fff8230: fa fa fa fa fd fd fd fd fd fd[fd]fd fd fd fa fa
  0x0c0e7fff8240: fa fa 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
  0x0c0e7fff8250: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 00 00
  0x0c0e7fff8260: 00 00 00 00 00 00 04 fa fa fa fa fa 00 00 00 00
  0x0c0e7fff8270: 00 00 00 00 00 00 fa fa fa fa 00 00 00 00 00 00
  0x0c0e7fff8280: 00 00 00 00 fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==31438==ABORTING

[Frederic Cambus]

This issue has been assigned CVE-2019-16396.

[Edward Hart]

Fixed in [r3347]. Caused by end_scope_of_program_name trying to free the first program with the given name, not the intended, nested, program with that name.