Onigmo icon indicating copy to clipboard operation
Onigmo copied to clipboard

Fix out of bounds memory read in `onig_node_str_cat`

Open sashashura opened this issue 2 years ago • 3 comments

This PR fixes out of bounds memory read in onig_node_str_cat revealed by fuzzing fluent-bit: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46049

The root cause is that a call to enclen inside of PFETCH macro when called in fetch_token results in a call to onigenc_mbclen_approximate. When the value of p passed to the function is \xec even though it is the last byte in multibyte sequince (the next byte is unexpected string terminator \0) the onigenc_mbclen_approximate returns it's size as 4. The size is added to the overall string length and results in reading past the end of the string.

sashashura avatar Jul 15 '22 18:07 sashashura

@k-takata?

sashashura avatar Jul 26 '22 07:07 sashashura

Given https://github.com/k-takata/Onigmo/pull/165 and this PR, does it make sense to create a fork that accepts security patches and then use that fork?

DavidKorczynski avatar Sep 02 '22 10:09 DavidKorczynski

I have contemplated making local temporary changes in https://github.com/fluent/fluent-bit/tree/master/lib/onigmo. Making a temporary fork for security patches only until this repository gets back to life is an option if there are more dependent repositories willing to adopt it. In any case fluent-bit maintainers have to be convinced to make a change (either local patch or reference another fork), but they hesitate to accept security patches even in their code so far.

sashashura avatar Sep 02 '22 13:09 sashashura