search

adrian-thurston / colm

The Colm Programming Language
MIT License
164 stars 31 forks source link

Heap buffer overflow in data_undo_consume_data(stream.c) #148

Closed koltiradw closed 1 year ago

koltiradw commented 2 years ago

Hi! I was playing with Honggfuzz and found crash in data_undo_consume_data:

=================================================================
==289758==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500001b120 at pc 0x00000049948a bp 0x7fff52d0ea50 sp 0x7fff52d0e218
WRITE of size 49122 at 0x62500001b120 thread T0
    #0 0x499489 in __asan_memcpy (/colm/src/colm+0x499489)
    #1 0x7f09a4 in data_undo_consume_data /colm/src/stream.c:615:3
    #2 0x7eb908 in input_undo_consume_data /colm/src/input.c:431:22
    #3 0x7e9ddb in send_back_text /colm/src/pdarun.c:157:2
    #4 0x7e8580 in send_back /colm/src/pdarun.c:256:3
    #5 0x7e2afe in parse_token /colm/src/pdarun.c:1756:6
    #6 0x7da68c in colm_parse_loop /colm/src/pdarun.c:2114:14
    #7 0x7e4c78 in colm_parse_frag /colm/src/pdarun.c:2189:14
    #8 0x82fae1 in colm_execute_code /colm/src/bytecode.c:2755:16
    #9 0x805a38 in colm_execute /colm/src/bytecode.c:582:7
    #10 0x8643bd in colm_run_program2 /colm/src/program.c:222:2
    #11 0x864526 in colm_run_program /colm/src/program.c:231:2
    #12 0x4d39ae in LoadColm::go(long) /colm/src/./loadfinal.cc:2990:2
    #13 0x4d0a57 in main /colm/src/main.cc:765:10
    #14 0x7f0bfab150b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #15 0x41f16d in _start (/colm/src/colm+0x41f16d)

File for repoducing: crash.txt