gnuplot / Bugs / #2088 Out-of-bounds read in strlen

A portable, multi-platform, command-line driven graphing utility

#2088 Out-of-bounds read in strlen_tex()

Milestone: None

Status: closed-fixed

Owner: nobody

Labels: None

Priority:

Updated: 2019-01-02

Created: 2018-11-19

Creator: Nils Bars

Private: No

Version:
gnuplot 5.2 patchlevel 5

Description:
Using the '[' character in the context terminal mode, cause an out-of-bounds read in strlen_tex().

Steps to reproduce (payload is attached):

gnuplot <payload>

ASAN-Report:

-------- STDERR --------
Warning: empty y range [-9:-9], adjusting to [-9.09:-8.91]
Warning: empty y range [0:0], adjusting to [-1:1]
=================================================================
==20760==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000c293 at pc 0x5643f295fef6 bp 0x7ffea069fa80 sp 0x7ffea069fa70
READ of size 1 at 0x60300000c293 thread T0
    #0 0x5643f295fef5 in strlen_tex /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/term.c:2955
    #1 0x5643f295ce32 in estimate_strlen /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/term.c:2615
    #2 0x5643f2703a01 in find_maxl_keys3d /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/graph3d.c:259
    #3 0x5643f27040ea in boundary3d /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/graph3d.c:324
    #4 0x5643f2709afd in do_3dplot /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/graph3d.c:733
    #5 0x5643f281f325 in eval_3dplots /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot3d.c:2395
    #6 0x5643f2806a9c in plot3drequest /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot3d.c:328
    #7 0x5643f26b80f4 in splot_command /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:2263
    #8 0x5643f26b160d in command /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:629
    #9 0x5643f26b04fe in do_line /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:419
    #10 0x5643f27a1f22 in load_file /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/misc.c:447
    #11 0x5643f27d0de7 in main /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot.c:654
    #12 0x7f699a14f222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
    #13 0x5643f26850ed in _start (/home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/gnuplot+0xf20ed)

0x60300000c293 is located 0 bytes to the right of 19-byte region [0x60300000c280,0x60300000c293)
allocated by thread T0 here:
    #0 0x7f699cebcf01 in __interceptor_strdup /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:405
    #1 0x5643f2971d98 in gp_strdup /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/util.c:381
    #2 0x5643f26e5535 in push /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/eval.c:550
    #3 0x5643f277e94d in f_pushc /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/internal.c:104
    #4 0x5643f26e5d72 in execute_at /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/eval.c:679
    #5 0x5643f26e5eed in evaluate_at /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/eval.c:707
    #6 0x5643f27c6aa4 in const_express /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/parse.c:169
    #7 0x5643f27c6946 in const_string_express /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/parse.c:153
    #8 0x5643f2971c6c in try_to_get_string /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/util.c:352
    #9 0x5643f2804b21 in parse_plot_title /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot2d.c:3600
    #10 0x5643f281889c in eval_3dplots /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot3d.c:1590
    #11 0x5643f2806a9c in plot3drequest /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot3d.c:328
    #12 0x5643f26b80f4 in splot_command /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:2263
    #13 0x5643f26b160d in command /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:629
    #14 0x5643f26b04fe in do_line /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/command.c:419
    #15 0x5643f27a1f22 in load_file /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/misc.c:447
    #16 0x5643f27d0de7 in main /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/plot.c:654
    #17 0x7f699a14f222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/nils/git/gnuplot-crash-triage/gnuplot-5.2.5/src/term.c:2955 in strlen_tex
Shadow bytes around the buggy address:
  0x0c067fff9800: fa fa 00 00 02 fa fa fa 00 00 01 fa fa fa 00 00
  0x0c067fff9810: 01 fa fa fa 00 00 01 fa fa fa 00 00 01 fa fa fa
  0x0c067fff9820: 00 00 01 fa fa fa 00 00 01 fa fa fa 00 00 02 fa
  0x0c067fff9830: fa fa 00 00 03 fa fa fa 00 00 01 fa fa fa 00 00
  0x0c067fff9840: 01 fa fa fa 00 00 02 fa fa fa 00 00 04 fa fa fa
=>0x0c067fff9850: 00 00[03]fa fa fa 00 00 00 fa fa fa 00 00 00 03
  0x0c067fff9860: fa fa 00 00 00 03 fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff9890: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c067fff98a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==20760==ABORTING

Credits:
Tim Blazytko
Cornelius Aschermann
Sergej Schumilo
Nils Bars

1 Attachments

33a227f9033a9594.payload

Discussion

Nils Bars - 2018-11-19

Description has changed:

Diff:

--- old +++ new @@ -87,3 +87,9 @@ Right alloca redzone: cb ==20760==ABORTING ~~~ + +Credits: +Tim Blazytko +Cornelius Aschermann +Sergej Schumilo +Nils Bars

Group: -->

Priority: -->
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ethan Merritt - 2018-11-20

status: open --> pending-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ethan Merritt - 2018-11-20

fixed in 5.2 and 5.3

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ethan Merritt - 2019-01-02

Status: pending-fixed --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Out-of-bounds read in strlen_tex()

A portable, multi-platform, command-line driven graphing utility

Priority

Searches

Help

#2088 Out-of-bounds read in strlen_tex()

Discussion