segmentation fault in binwalk

[GoogleCodeExporter]

What steps will reproduce the problem?

1. unpack a dir615 firmware dd-wrt v24 preSP2

What is the expected output? What do you see instead?

Binwalk segfaults on vsprintf due to some null strings

Quick and dirty patch attached.

Original issue reported on code.google.com by zeynel.b...@gmail.com on 25 Nov 2011 at 10:06

Attachments:

• binwalk_segfault.patch

[GoogleCodeExporter]

Thanks for the report, I've added it to the issues list at the Binwalk project 
page (http://binwalk.googlecode.com). 

I'd like to reproduce the bug - can you tell me exactly which firmware image 
caused the seg fault? I tried against 
http://dd-wrt.com/routerdb/de/download/D-Link/DIR-615/C1/dir615c1-firmware.bin/3
588 but could not reproduce the issue.

Original comment by heffne...@gmail.com on 25 Nov 2011 at 4:31

• Changed state: Accepted

[GoogleCodeExporter]

Hi,

some more info:

I am using gcc (Debian 4.6.2-4) 4.6.2
The firmware extracted is 
http://dd-wrt.com/routerdb/de/download/D-Link/DIR-615/D3/dir615d-ddwrt-webflash.
bin/3829 (think the D3 version is germany specific (?))
My kernel is x86_64 (Linux super 3.1.0-1-amd64 #1 SMP Mon Nov 14 08:02:25 UTC 
2011 x86_64 GNU/Linux)

I attached the valgrind log and the log of the extract-ng.sh script.

Original comment by zeynel.b...@gmail.com on 26 Nov 2011 at 1:09

Attachments:

• extract_run_valgrind.log
• command.log

[GoogleCodeExporter]

By the way, just noticed that the binwalk log in fmk/logs/binwalk.log seems to 
look fine ...

Original comment by zeynel.b...@gmail.com on 26 Nov 2011 at 1:13

[GoogleCodeExporter]

Thanks for the additional information. I tested the firmware image on Ubuntu 
10.04 Linux ubuntu 2.6.32-33-generic #71-Ubuntu SMP Wed Jul 20 17:27:30 UTC 
2011 x86_64 GNU/Linux) with gcc 4.4.3 (Ubuntu 4.4.3-4ubuntu5), but binwalk ran 
without error. 

I can easily apply the patch, it's simple enough, but I'd really like to 
understand what is causing the NULL string. The code explicitly checks the 
'type' string pointer for NULL, and does not call print if type is NULL, so I'm 
not sure how a NULL string is getting passed to vfprintf in the first place.

Original comment by heffne...@gmail.com on 26 Nov 2011 at 2:20

[GoogleCodeExporter]

Maybe it's something specific with my gcc version. Also you can recognize this 
maybe because the patch is rather stupid. The print function works with null 
strings if only one %s is present in the format string, if there are others it 
seems to fail. So splitting up the print into two fixes the crash problem for 
me, but I do not understand why... also had the same thoughts as you as there 
are explicit checks for null ...

Original comment by zeynel.b...@gmail.com on 26 Nov 2011 at 4:49

[GoogleCodeExporter]

I could be a gcc issue, not sure - definitely odd though. In any case, if 
splitting the print statement into two print statements fixes the issue I'll do 
that as it won't hurt anything else. I'll apply the changes back to the main 
binwalk project as well. Thanks!

Original comment by heffne...@gmail.com on 26 Nov 2011 at 5:12

[GoogleCodeExporter]

Upgraded binwalk to v0.4.1 which fixes this issue.

Original comment by heffne...@gmail.com on 3 Dec 2011 at 3:46

• Changed state: Fixed