Heap-buffer-overflow in mz_os.c:71 mz_path_has_slash #739
Comments
|
Where did
so does and |
poc0 is a malformed zip file generated by fuzzer. I used the "-x" flag when testing and it came into a heap-buffer-overflow crash. So maybe you could give a proper prompt when using "-x" to extract malformed files like poc0? |
Aaaah, ok. When built without ASAN the That said, there is still a buffer overflow present. Let's take a look at that FYI - the cmake build now support building with ASAN, like this. When I run that I get the line numbers where the problems are Memory allocation in the The error is triggered in the This needs further analysis |
|
Does checking for |
Yes it does. The error is triggered when Fix in PR #741 |
|
@Akane0721 are your fuzz test available somewhere? They don't appear to be in the fuzzing that this project uses. |
|
Thanks @Akane0721 but I don't see the fuzz test you used for minizip in that repo. Have I missed something? If you specific tests that use NestFuzz can you share them? |
Sorry, I'm not quite clear on what you mean by "fuzz test." Are you referring to the fuzzer's output folder for minizip or the fuzzer_stats file or something? |
No. problem. The question is how to reproduce the test you ran with minizip + NestFuzz that highlighted the issue you have reported? |
output_dir link: https://github.com/Akane0721/POC/tree/f2b5178655c1e8fa9acbc1d6ba50be0c62d36016/minizip-out-folder (only kept the non-duplicated "crashes" files), and the input seed zip file is also put there. fuzzer command: export AFL_USE_ASAN=1
CC="path/to/NestFuzz/afl-gcc" CXX="path/to/NestFuzz/afl-g++" cmake -S . -B build -D MZ_BUILD_TESTS=ON
cmake --build build
path/to/NestFuzz/./afl-fuzz -m none -d -i $INPUT -o $OUTPUT -- $PROG -x -o @@input logic processing command: CC="path/to/NestFuzz/ipl-modeling/install/test-clang" CXX="path/to/NestFuzz/ipl-modeling/install/test-clang++" cmake -S . -B build -D MZ_BUILD_TESTS=ON
cmake --build build
python3 $ROOTDIR/fuzzer/NestFuzz/isi.py -t 300 -o $OUTPUT -l $LOG -- $PROGINFER -x -o @@ |
|
Thanks @Akane0721 ! |
nmoinvaz
added
fixed
|
Fixed in 4.0.3. Thank you! |
Description
heap-buffer-overflow (/minizip-ng/build/minizip+0x8d5a) in mz_path_has_slash
Version
Replay
ASAN
-x -o /root/poc/minizip/poc0 Archive /root/poc/minizip/poc0 Extracting .\ ================================================================= ==1735959==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000cf at pc 0x55555555cd5b bp 0x7fffffffdd20 sp 0x7fffffffdd10 READ of size 1 at 0x6020000000cf thread T0 #0 0x55555555cd5a in mz_path_has_slash (/root/test/minizip-ng/build/minizip+0x8d5a) #1 0x555555572ac1 in mz_zip_reader_entry_save_file (/root/test/minizip-ng/build/minizip+0x1eac1) #2 0x555555573ceb in mz_zip_reader_save_all (/root/test/minizip-ng/build/minizip+0x1fceb) #3 0x55555555af70 in minizip_extract (/root/test/minizip-ng/build/minizip+0x6f70) #4 0x55555555c7ec in main (/root/test/minizip-ng/build/minizip+0x87ec) #5 0x7ffff73a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) #6 0x555555558aed in _start (/root/test/minizip-ng/build/minizip+0x4aed) 0x6020000000cf is located 1 bytes to the left of 1-byte region [0x6020000000d0,0x6020000000d1) allocated by thread T0 here: #0 0x7ffff76a0a06 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153 #1 0x555555572749 in mz_zip_reader_entry_save_file (/root/test/minizip-ng/build/minizip+0x1e749) #2 0x555555573ceb in mz_zip_reader_save_all (/root/test/minizip-ng/build/minizip+0x1fceb) #3 0x55555555af70 in minizip_extract (/root/test/minizip-ng/build/minizip+0x6f70) #4 0x55555555c7ec in main (/root/test/minizip-ng/build/minizip+0x87ec) #5 0x7ffff73a9082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082) SUMMARY: AddressSanitizer: heap-buffer-overflow (/root/test/minizip-ng/build/minizip+0x8d5a) in mz_path_has_slash Shadow bytes around the buggy address: 0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c047fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c047fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c047fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c047fff8000: fa fa fd fd fa fa fd fd fa fa 00 07 fa fa 00 01 =>0x0c047fff8010: fa fa 00 01 fa fa 00 01 fa[fa]01 fa fa fa 01 fa 0x0c047fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c047fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==1735959==ABORTINGPOC
https://github.com/Akane0721/POC/blob/f37d805631e0a15bea1f15b6e1edfb3246a2e0fc/minizip-ng/poc0
Environment
The text was updated successfully, but these errors were encountered: