heap-buffer overflow in FileStream.cpp

[gabe-sherman]

A heap-buffer overflow occurs in the below program when provided with malformed input. This behavior occurs at line 249 in FileStream.cpp.

#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include <stdlib.h>
#include "StormLib.h"

int main(int argc, char *argv[])
{
    HANDLE v0 = NULL;
    bool v1 = SFileOpenArchive(argv[1], 0, STREAM_PROVIDER_FLAT, &v0);

    return 0;
}

Test Environment

Ubuntu 22.04, 64bit

How to trigger

./filename poc

Version

Latest: 6052223

Poc File

https://github.com/FuturesLab/POC/blob/main/storm/poc14

Address Sanitizer Output

=================================================================
==440755==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000451 at pc 0x55555570ead8 bp 0x7fffffffc520 sp 0x7fffffffbcf8
WRITE of size 928 at 0x612000000451 thread T0
    #0 0x55555570ead7 in __interceptor_read (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer+0x1baad7) (BuildId: 01aac6b92a0a6ebb8a65fb1042745cb9acba9c6a)
    #1 0x5555557f01b1 in BaseFile_Read(TFileStream*, unsigned long long*, void*, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/FileStream.cpp:249:26
    #2 0x5555557ec858 in FileStream_Read /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/FileStream.cpp:2762:12
    #3 0x5555558aa378 in ReadMpqFileSingleUnit(_TMPQFile*, void*, unsigned int, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileReadFile.cpp:275:13
    #4 0x5555558a61b5 in SFileReadFile /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileReadFile.cpp:743:21
    #5 0x555555895d20 in LoadListFile_MPQ(TListFileHandle*, void*, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:73:12
    #6 0x555555895840 in CreateListFileCache(bool (*)(TListFileHandle*, void*, unsigned int, unsigned int*), TListFileHandle*, char const*, unsigned int, unsigned int, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:127:9
    #7 0x5555558933eb in CreateListFileCache(void*, char const*, char const*, unsigned int, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:170:22
    #8 0x5555558918b8 in SFileAddArbitraryListFile(_TMPQArchive*, void*, char const*, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:540:14
    #9 0x555555891db4 in SFileAddInternalListFile(_TMPQArchive*, void*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:607:25
    #10 0x555555891617 in SFileAddListFile /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:671:25
    #11 0x5555557b867d in SFileOpenArchive /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileOpenArchive.cpp:533:13
    #12 0x5555557b386f in main /home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer.c:10:15
    #13 0x7ffff7829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #14 0x7ffff7829e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #15 0x5555556f34b4 in _start (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer+0x19f4b4) (BuildId: 01aac6b92a0a6ebb8a65fb1042745cb9acba9c6a)

0x612000000451 is located 0 bytes to the right of 273-byte region [0x612000000340,0x612000000451)
allocated by thread T0 here:
    #0 0x5555557762fe in malloc (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer+0x2222fe) (BuildId: 01aac6b92a0a6ebb8a65fb1042745cb9acba9c6a)
    #1 0x555555821e74 in AllocateSectorBuffer(_TMPQFile*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SBaseCommon.cpp:1146:24
    #2 0x5555558a9b13 in ReadMpqFileSingleUnit(_TMPQFile*, void*, unsigned int, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileReadFile.cpp:251:21
    #3 0x5555558a61b5 in SFileReadFile /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileReadFile.cpp:743:21
    #4 0x555555895d20 in LoadListFile_MPQ(TListFileHandle*, void*, unsigned int, unsigned int*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:73:12
    #5 0x555555895840 in CreateListFileCache(bool (*)(TListFileHandle*, void*, unsigned int, unsigned int*), TListFileHandle*, char const*, unsigned int, unsigned int, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:127:9
    #6 0x5555558933eb in CreateListFileCache(void*, char const*, char const*, unsigned int, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:170:22
    #7 0x5555558918b8 in SFileAddArbitraryListFile(_TMPQArchive*, void*, char const*, unsigned int) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:540:14
    #8 0x555555891db4 in SFileAddInternalListFile(_TMPQArchive*, void*) /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:607:25
    #9 0x555555891617 in SFileAddListFile /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileListFile.cpp:671:25
    #10 0x5555557b867d in SFileOpenArchive /home/gabesherman/harness_test/AutoHarn-Evaluation/storm/lib_asan/src/SFileOpenArchive.cpp:533:13
    #11 0x5555557b386f in main /home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer.c:10:15
    #12 0x7ffff7829d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/gabesherman/harness_test/AutoHarn-Results/storm/autoharn-14/reproducer+0x1baad7) (BuildId: 01aac6b92a0a6ebb8a65fb1042745cb9acba9c6a) in __interceptor_read
Shadow bytes around the buggy address:
  0x0c247fff8030: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c247fff8050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02
  0x0c247fff8060: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c247fff8070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8080: 00 00 00 00 00 00 00 00 00 00[01]fa fa fa fa fa
  0x0c247fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c247fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==440755==ABORTING

[ladislav-zezula]

Fixed in 355665c