search

kanaka / wac

WebAssembly interpreter in C
Other
469 stars 44 forks source link

Multiple heap-buffer-overflow in load_module #18

Open haruki3hhh opened 6 months ago

haruki3hhh commented 6 months ago

Version

385e13ca840100f70d05781f45209da82fb6c45c

Compile

CFLAGS="-g -fsanitize=address" make

ASAN Report

root@9dc6ce043bcb:~/Ablation/wasm-fuzz/fuzz_out_wac/crashes# ./wace id:000220,sig:11,src:001688,op:python,pos:0
=================================================================
==4631==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf3c004d4 at pc 0x56665510 bp 0xffcd8328 sp 0xffcd8318
WRITE of size 4 at 0xf3c004d4 thread T0
    #0 0x5666550f in load_module /root/Ablation/wac-asan/wa.c:1806
    #1 0x566680e9 in main /root/Ablation/wac-asan/wace.c:64
    #2 0xf73c7ed4 in __libc_start_main ../csu/libc-start.c:308
    #3 0x5664b704 in _start (/root/Ablation/wac-asan/wace+0x3704)

0xf3c004d4 is located 0 bytes to the right of 4-byte region [0xf3c004d0,0xf3c004d4)
allocated by thread T0 here:
    #0 0xf7a1a9f7 in __interceptor_calloc ../../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
    #1 0x56667299 in acalloc /root/Ablation/wac-asan/platform_libc.c:16
    #2 0x566640f7 in load_module /root/Ablation/wac-asan/wa.c:1694
    #3 0x566680e9 in main /root/Ablation/wac-asan/wace.c:64
    #4 0xf73c7ed4 in __libc_start_main ../csu/libc-start.c:308

Reproduce

./wace https://github.com/haruki3hhh/fuzzing/blob/main/wac/id%3A000220%2Csig%3A11%2Csrc%3A001688%2Cop%3Apython%2Cpos%3A0

haruki3hhh commented 6 months ago

Version

385e13ca840100f70d05781f45209da82fb6c45c

Compile

CFLAGS="-g -fsanitize=address" make

ASAN Report

root@9dc6ce043bcb:~/Ablation/wasm-fuzz/fuzz_out_wac/crashes# ./wace id:000220,sig:11,src:001688,op:python,pos:0
=================================================================
==4631==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf3c004d4 at pc 0x56665510 bp 0xffcd8328 sp 0xffcd8318
WRITE of size 4 at 0xf3c004d4 thread T0
    #0 0x5666550f in load_module /root/Ablation/wac-asan/wa.c:1806
    #1 0x566680e9 in main /root/Ablation/wac-asan/wace.c:64
    #2 0xf73c7ed4 in __libc_start_main ../csu/libc-start.c:308
    #3 0x5664b704 in _start (/root/Ablation/wac-asan/wace+0x3704)

0xf3c004d4 is located 0 bytes to the right of 4-byte region [0xf3c004d0,0xf3c004d4)
allocated by thread T0 here:
    #0 0xf7a1a9f7 in __interceptor_calloc ../../../../../src/libsanitizer/asan/asan_malloc_linux.cc:153
    #1 0x56667299 in acalloc /root/Ablation/wac-asan/platform_libc.c:16
    #2 0x566640f7 in load_module /root/Ablation/wac-asan/wa.c:1694
    #3 0x566680e9 in main /root/Ablation/wac-asan/wace.c:64
    #4 0xf73c7ed4 in __libc_start_main ../csu/libc-start.c:308

Reproduce

./wace https://github.com/haruki3hhh/fuzzing/blob/main/wac/id%3A000060%2Csig%3A11%2Csrc%3A000707%2Cop%3Apython%2Cpos%3A0