heap-buffer oveflow in huff.cpp #336
Description
A heap-buffer overflow occurs in the below program when provided with malformed input. This behavior occurs at line 281 in huff.cpp
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <stdlib.h>
#include "StormLib.h"
int main(int argc, char *argv[])
{
HANDLE v0 = NULL;
bool v1 = SFileOpenArchive(argv[1], 0, BASE_PROVIDER_FILE, &v0);
if (v1 == false) exit(1);
SFileCompactArchive(v0, argv[1], true);
return 0;
}
Test Environment
Ubuntu 22.04, 64bit
How to trigger
./filename poc
Version
Latest: 6052223
Poc File
https://github.com/FuturesLab/POC/blob/main/storm/poc18
Address Sanitizer Output
==698482==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x611000000140 at pc 0x555555a096c0 bp 0x7fffffff6250 sp 0x7fffffff6248
READ of size 1 at 0x611000000140 thread T0
#0 0x555555a096bf in TInputStream::Get1Bit() /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/huffman/huff.cpp:281:21
#1 0x555555a0fa99 in THuffmannTree::DecodeOneByte(TInputStream*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/huffman/huff.cpp:740:21
#2 0x555555a11f9d in THuffmannTree::Decompress(void*, unsigned int, TInputStream*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/huffman/huff.cpp:863:32
#3 0x5555558929b9 in Decompress_huff(void*, int*, void*, int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SCompression.cpp:86:24
#4 0x555555899862 in SCompDecompress2 /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SCompression.cpp:1133:15
#5 0x555555845ebb in LoadMpqTable(_TMPQArchive*, unsigned long long, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseCommon.cpp:1082:21
#6 0x5555558766a6 in LoadHashTable(_TMPQArchive*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseFileTable.cpp:2367:38
#7 0x555555875829 in LoadAnyHashTable(_TMPQArchive*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseFileTable.cpp:2511:26
#8 0x5555557cce14 in SFileOpenArchive /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileOpenArchive.cpp:515:21
#9 0x5555557b7878 in main /home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-18/reproducer.c:11:15
#10 0x7ffff7829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#11 0x7ffff7829e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#12 0x5555556f74b4 in _start (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-18/reproducer+0x1a34b4) (BuildId: 09b711eced93bc3115d0341cfb46db2897bdb0bc)
0x611000000140 is located 0 bytes to the right of 256-byte region [0x611000000040,0x611000000140)
allocated by thread T0 here:
#0 0x55555577a2fe in malloc (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-18/reproducer+0x2262fe) (BuildId: 09b711eced93bc3115d0341cfb46db2897bdb0bc)
#1 0x55555584577d in LoadMpqTable(_TMPQArchive*, unsigned long long, unsigned char*, unsigned int, unsigned int, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseCommon.cpp:1013:39
#2 0x5555558766a6 in LoadHashTable(_TMPQArchive*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseFileTable.cpp:2367:38
#3 0x555555875829 in LoadAnyHashTable(_TMPQArchive*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseFileTable.cpp:2511:26
#4 0x5555557cce14 in SFileOpenArchive /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileOpenArchive.cpp:515:21
#5 0x5555557b7878 in main /home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-18/reproducer.c:11:15
#6 0x7ffff7829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/huffman/huff.cpp:281:21 in TInputStream::Get1Bit()
Shadow bytes around the buggy address:
0x0c227fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c227fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c227fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c227fff8020: 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa
0x0c227fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c227fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==698482==ABORTING