| Summary: | [busybox 1.36.1] global-buffer-overflow in od | ||
|---|---|---|---|
| Product: | Busybox | Reporter: | Frank Busse <f.busse> |
| Component: | Other | Assignee: | unassigned |
| Status: | NEW --- | ||
| Severity: | normal | CC: | busybox-cvs |
| Priority: | P5 | ||
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Host: | Target: | ||
| Build: | |||
Passing "-An" as argument results in an out-of-bound access in od: $ /tmp/root/busybox-1.36.1/bin/busybox od -An coreutils/od_bloaty.c:1236:45: runtime error: index 3 out of bounds for type 'char [3]' coreutils/od_bloaty.c:1236:45: runtime error: load of address 0x55e512d67703 with insufficient space for an object of type 'const char' 0x55e512d67703: note: pointer points here 00 75 6f 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ================================================================= ==457==ERROR: AddressSanitizer: global-buffer-overflow on address 0x55e512d67703 at pc 0x55e512cfd867 bp 0x7ffc45c79130 sp 0x7ffc45c79120 READ of size 1 at 0x55e512d67703 thread T0 #0 0x55e512cfd866 in od_main coreutils/od_bloaty.c:1236 0x55e512d67703 is located 61 bytes to the left of global variable 'doxn' defined in 'coreutils/od_bloaty.c:1221:21' (0x55e512d67740) of size 5 'doxn' is ascii string 'doxn' 0x55e512d67703 is located 0 bytes to the right of global variable 'doxn_address_base_char' defined in 'coreutils/od_bloaty.c:1222:21' (0x55e512d67700) of size 3 SUMMARY: AddressSanitizer: global-buffer-overflow coreutils/od_bloaty.c:1236 in od_main Shadow bytes around the buggy address: 0x0abd225a4e90: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 0x0abd225a4ea0: 04 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 0x0abd225a4eb0: 00 00 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 0x0abd225a4ec0: 04 f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 0x0abd225a4ed0: 00 00 00 f9 f9 f9 f9 f9 03 f9 f9 f9 f9 f9 f9 f9 =>0x0abd225a4ee0:[03]f9 f9 f9 f9 f9 f9 f9 05 f9 f9 f9 f9 f9 f9 f9 0x0abd225a4ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 0x0abd225a4f00: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 01 f9 f9 0x0abd225a4f10: f9 f9 f9 f9 00 01 f9 f9 f9 f9 f9 f9 00 00 01 f9 0x0abd225a4f20: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 00 00 01 f9 0x0abd225a4f30: f9 f9 f9 f9 00 00 01 f9 f9 f9 f9 f9 02 f9 f9 f9 (found by KLEE)