Onigmo
Onigmo copied to clipboard
Fix out of bounds memory read in `onig_node_str_cat`
This PR fixes out of bounds memory read in onig_node_str_cat
revealed by fuzzing fluent-bit:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46049
The root cause is that a call to enclen
inside of PFETCH
macro when called in fetch_token
results in a call to onigenc_mbclen_approximate
.
When the value of p
passed to the function is \xec
even though it is the last byte in multibyte sequince (the next byte is unexpected string terminator \0) the onigenc_mbclen_approximate
returns it's size as 4. The size is added to the overall string length and results in reading past the end of the string.
@k-takata?
Given https://github.com/k-takata/Onigmo/pull/165 and this PR, does it make sense to create a fork that accepts security patches and then use that fork?
I have contemplated making local temporary changes in https://github.com/fluent/fluent-bit/tree/master/lib/onigmo. Making a temporary fork for security patches only until this repository gets back to life is an option if there are more dependent repositories willing to adopt it. In any case fluent-bit maintainers have to be convinced to make a change (either local patch or reference another fork), but they hesitate to accept security patches even in their code so far.