hstr
hstr copied to clipboard
heap buffer overflow with invalid .zsh_history file
➜ hstr-ori git:(master) ✗ ./src/hstr -n
=================================================================
==123306==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000003f2 at pc 0x55a873ba9774 bp 0x7ffc36045bc0 sp 0x7ffc36045bb8
READ of size 1 at 0x6020000003f2 thread T0
#0 0x55a873ba9773 (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x119773)
#1 0x55a873ba9ce7 (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x119ce7)
#2 0x55a873bb95e0 (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x1295e0)
#3 0x55a873bb9cad (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x129cad)
#4 0x7f3ba0e06082 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x24082) (BuildId: 1878e6b475720c7c51969e69ab2d276fae6d1dee)
#5 0x55a873ab159d (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x2159d)
0x6020000003f2 is located 0 bytes to the right of 2-byte region [0x6020000003f0,0x6020000003f2)
allocated by thread T0 here:
#0 0x55a873b62577 (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0xd2577)
#1 0x7f3ba123500c (/usr/lib/x86_64-linux-gnu/libreadline.so.8+0x3c00c) (BuildId: b26b37d04de63161632027760514b3256bf2062d)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/juhee/project/foxfuzz/programs/file/hstr-ori/src/hstr+0x119773)
Shadow bytes around the buggy address:
0x0c047fff8020: fa fa fd fa fa fa 00 04 fa fa fd fd fa fa fd fd
0x0c047fff8030: fa fa fd fd fa fa fd fd fa fa fd fd fa fa 03 fa
0x0c047fff8040: fa fa 04 fa fa fa 03 fa fa fa 06 fa fa fa 05 fa
0x0c047fff8050: fa fa 03 fa fa fa 03 fa fa fa 04 fa fa fa 05 fa
0x0c047fff8060: fa fa 04 fa fa fa 07 fa fa fa 06 fa fa fa 04 fa
=>0x0c047fff8070: fa fa 04 fa fa fa fd fa fa fa 00 04 fa fa[02]fa
0x0c047fff8080: fa fa 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==123306==ABORTING
when .zsh_histroy contains following line
: