#2426 heap-buffer-overflow on strlen

[liuchenyifan]

gnuplot 5.5 (last modified in 9.18) on centos linux 7.7.1908

==4249== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x605a0001e180 at pc 0x45b669 bp 0x7ffc6e1fff40 sp 0x7ffc6e1fff30
READ of size 1 at 0x605a0001e180 thread T0
#0 0x45b668 (/root/uniafl_evaluation/asan_program/gnuplot+0x45b668)
#1 0x61b63b (/root/uniafl_evaluation/asan_program/gnuplot+0x61b63b)
#2 0x40772e (/root/uniafl_evaluation/asan_program/gnuplot+0x40772e)
#3 0x7f460cb02554 (/usr/lib64/libc-2.17.so+0x22554)
#4 0x4084ec (/root/uniafl_evaluation/asan_program/gnuplot+0x4084ec)
0x605a0001e180 is located 0 bytes inside of 3072-byte region [0x605a0001e180,0x605a0001ed80)
freed by thread T0 here:
#0 0x7f460e19408e (/usr/lib64/libasan.so.0.0.0+0x1608e)
#1 0x408665 (/root/uniafl_evaluation/asan_program/gnuplot+0x408665)
previously allocated by thread T0 here:
#0 0x7f460e19408e (/usr/lib64/libasan.so.0.0.0+0x1608e)
#1 0x408665 (/root/uniafl_evaluation/asan_program/gnuplot+0x408665)
Shadow bytes around the buggy address:
0x0c0bbfffbbe0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbbf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0bbfffbc30:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0bbfffbc80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap righ redzone: fb
Freed Heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==4249== ABORTING

information below from valgrind:
==4231== Invalid read of size 1
==4231== at 0x4C2D0F2: strlen (vg_replace_strmem.c:459)
==4231== by 0x43FDFF: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff900 is 2,112 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 1
==4231== at 0x4C2D104: strlen (vg_replace_strmem.c:459)
==4231== by 0x43FDFF: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff901 is 2,113 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 8
==4231== at 0x4C2E683: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1032)
==4231== by 0x43FE0D: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff900 is 2,112 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 8
==4231== at 0x4C2E697: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1032)
==4231== by 0x43FE0D: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff908 is 2,120 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 8
==4231== at 0x4C2E69F: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1032)
==4231== by 0x43FE0D: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff910 is 2,128 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 8
==4231== at 0x4C2E6A7: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1032)
==4231== by 0x43FE0D: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff918 is 2,136 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 8
==4231== at 0x4C2E68C: memcpy@GLIBC_2.2.5 (vg_replace_strmem.c:1032)
==4231== by 0x43FE0D: do_line (command.c:373)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff920 is 2,144 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 1
==4231== at 0x4C2D0F2: strlen (vg_replace_strmem.c:459)
==4231== by 0x43FE15: do_line (command.c:375)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff900 is 2,112 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231== Invalid read of size 1
==4231== at 0x4C2D104: strlen (vg_replace_strmem.c:459)
==4231== by 0x43FE15: do_line (command.c:375)
==4231== by 0x5CD14B: load_file (misc.c:335)
==4231== by 0x406416: main (plot.c:636)
==4231== Address 0x64ff901 is 2,113 bytes inside an unallocated block of size 9,552 in arena "client"
==4231==
==4231==
==4231== HEAP SUMMARY:
==4231== in use at exit: 883,048 bytes in 293 blocks
==4231== total heap usage: 2,081 allocs, 1,788 frees, 703,912,362 bytes allocated
==4231==
==4231== LEAK SUMMARY:
==4231== definitely lost: 0 bytes in 0 blocks
==4231== indirectly lost: 0 bytes in 0 blocks
==4231== possibly lost: 0 bytes in 0 blocks
==4231== still reachable: 883,048 bytes in 293 blocks
==4231== suppressed: 0 bytes in 0 blocks
==4231== Rerun with --leak-check=full to see details of leaked memory
==4231==
==4231== For lists of detected and suppressed errors, rerun with: -s
==4231== ERROR SUMMARY: 6530 errors from 9 contexts (suppressed: 0 from 0)