prism
prism copied to clipboard
ruby
Use-after-free (read) in pm_loop_modifier_block_exits
On 1da0733f147ed0a4547791576db53c04780cd498, testcase.c
#include <prism.h>
/*
00000000: 7420 6e65 7874 2626 646f 2065 6e64 263d t next&&do end&=
00000016: 2727 7768 696c 653d 20 ''while=
*/
uint8_t input[] = {
0x74, 0x20, 0x6e, 0x65, 0x78, 0x74, 0x26, 0x26, 0x64, 0x6f, 0x20, 0x65,
0x6e, 0x64, 0x26, 0x3d, 0x27, 0x27, 0x77, 0x68, 0x69, 0x6c, 0x65, 0x3d,
0x20
};
int main(int argc, const char **argv) {
(void)argc;
(void)argv;
pm_parse_success_p(input, sizeof(input), NULL);
return 0;
}
built with
$ clang -Iinclude $(find src -name "*.c") -ggdb3 testcase.c -fsanitize=address -o testcase
gives
$ ./testcase
=================================================================
==195==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000098 at pc 0xaaaab4cebed0 bp 0xfffffba5ac10 sp 0xfffffba5ac08
READ of size 8 at 0x604000000098 thread T0
#0 0xaaaab4cebecc in pm_loop_modifier_block_exits /prism/src/prism.c:7711:34
#1 0xaaaab4ce38cc in pm_while_node_modifier_create /prism/src/prism.c:7865:5
#2 0xaaaab4c6d070 in parse_expression_infix /prism/src/prism.c:22070:34
#3 0xaaaab4c54cd8 in parse_expression /prism/src/prism.c:22362:16
#4 0xaaaab4c3ca10 in parse_statements /prism/src/prism.c:13999:27
#5 0xaaaab4c23374 in parse_program /prism/src/prism.c:22583:40
#6 0xaaaab4c23188 in pm_parse /prism/src/prism.c:23015:12
#7 0xaaaab4c24188 in pm_parse_success_p /prism/src/prism.c:23132:23
#8 0xaaaab4d2e434 in main /prism/testcase.c:18:2
#9 0xffffa5d673fc in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#10 0xffffa5d674d4 in __libc_start_main csu/../csu/libc-start.c:392:3
#11 0xaaaab4ad302c in _start (/prism/testcase+0x5302c) (BuildId: 8bd424d93f1213736f3c7d7cedb2dc0f430adc2e)
0x604000000098 is located 8 bytes inside of 48-byte region [0x604000000090,0x6040000000c0)
freed by thread T0 here:
#0 0xaaaab4b7160c in free (/prism/testcase+0xf160c) (BuildId: 8bd424d93f1213736f3c7d7cedb2dc0f430adc2e)
#1 0xaaaab4cf68d0 in pm_node_destroy /prism/prism/templates/src/node.c.erb:143:5
#2 0xaaaab4cf193c in pm_node_destroy /prism/prism/templates/src/node.c.erb:112:13
#3 0xaaaab4cf6a08 in pm_node_list_destroy /prism/prism/templates/src/node.c.erb:96:45
#4 0xaaaab4cf19a4 in pm_node_destroy /prism/prism/templates/src/node.c.erb:112:13
#5 0xaaaab4cd8138 in parse_call_operator_write /prism/src/prism.c:21070:9
#6 0xaaaab4c6aa04 in parse_expression_infix /prism/src/prism.c:21798:21
#7 0xaaaab4c54cd8 in parse_expression /prism/src/prism.c:22362:16
#8 0xaaaab4c3ca10 in parse_statements /prism/src/prism.c:13999:27
#9 0xaaaab4c23374 in parse_program /prism/src/prism.c:22583:40
#10 0xaaaab4c23188 in pm_parse /prism/src/prism.c:23015:12
#11 0xaaaab4c24188 in pm_parse_success_p /prism/src/prism.c:23132:23
#12 0xaaaab4d2e434 in main /prism/testcase.c:18:2
#13 0xffffa5d673fc in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#14 0xffffa5d674d4 in __libc_start_main csu/../csu/libc-start.c:392:3
#15 0xaaaab4ad302c in _start (/prism/testcase+0x5302c) (BuildId: 8bd424d93f1213736f3c7d7cedb2dc0f430adc2e)
previously allocated by thread T0 here:
#0 0xaaaab4b71a7c in __interceptor_calloc (/prism/testcase+0xf1a7c) (BuildId: 8bd424d93f1213736f3c7d7cedb2dc0f430adc2e)
#1 0xaaaab4c6e78c in pm_node_alloc /prism/src/prism.c:1923:20
#2 0xaaaab4c90620 in pm_next_node_create /prism/src/prism.c:6094:28
#3 0xaaaab4c5df2c in parse_expression_prefix /prism/src/prism.c:19286:53
#4 0xaaaab4c54770 in parse_expression /prism/src/prism.c:22310:23
#5 0xaaaab4c6f2d4 in parse_value_expression /prism/src/prism.c:13311:23
#6 0xaaaab4c8f3b4 in parse_arguments /prism/src/prism.c:14398:32
#7 0xaaaab4c78948 in parse_arguments_list /prism/src/prism.c:15638:9
#8 0xaaaab4c5a534 in parse_expression_prefix /prism/src/prism.c:18727:21
#9 0xaaaab4c54770 in parse_expression /prism/src/prism.c:22310:23
#10 0xaaaab4c3ca10 in parse_statements /prism/src/prism.c:13999:27
#11 0xaaaab4c23374 in parse_program /prism/src/prism.c:22583:40
#12 0xaaaab4c23188 in pm_parse /prism/src/prism.c:23015:12
#13 0xaaaab4c24188 in pm_parse_success_p /prism/src/prism.c:23132:23
#14 0xaaaab4d2e434 in main /prism/testcase.c:18:2
#15 0xffffa5d673fc in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#16 0xffffa5d674d4 in __libc_start_main csu/../csu/libc-start.c:392:3
#17 0xaaaab4ad302c in _start (/prism/testcase+0x5302c) (BuildId: 8bd424d93f1213736f3c7d7cedb2dc0f430adc2e)
SUMMARY: AddressSanitizer: heap-use-after-free /prism/src/prism.c:7711:34 in pm_loop_modifier_block_exits
Shadow bytes around the buggy address:
0x603ffffffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x603ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x603fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x603fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x604000000000: fa fa 00 00 00 00 00 04 fa fa 00 00 00 00 00 00
=>0x604000000080: fa fa fd[fd]fd fd fd fd fa fa 00 00 00 00 00 00
0x604000000100: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x604000000180: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
0x604000000200: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x604000000280: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
0x604000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==195==ABORTING
