ASAN failures in various file processing commands

landley / toybox

toybox

http://landley.net/toybox

BSD Zero Clause License

2.44k stars 340 forks source link

ASAN failures in various file processing commands #503

Open edre opened 5 months ago

edre commented 5 months ago

Found via fuzzing. I have a patch that makes it easier to fuzz arguments to toybox commands. I can post it to the mailing list if it sounds generally useful.

heap-buffer-overflow:

toybox sed /[[
echo -ne '\0' | toybox sed hg
echo -e '\n\0aaaaaaa\nx' | toybox grep -B2 x

Segfault:

echo -ne '\x7fELF\00000000000000000000000000000000000000000000' > elf; toybox file elf
echo if > broken.sh; toybox sh -c '. broken.sh'

landley commented 5 months ago

I'm collecting them here, but I keep having to sign house sale closing paperwork (a notary is coming by on sunday with more) and I'm sort of curled up into a ball at the moment. Bit behind on stuff, sorry...

enh-google commented 3 months ago

patch for the file(1) crash sent to the mailing list: http://lists.landley.net/pipermail/toybox-landley.net/2024-August/030481.html