Local/Remote Crash (DoS) in SET_CAR - Githubissues

sasagawa888 / nprolog

interpreter and compiler to be compatible with ARITY/PROLOG（MS-DOS)

Other

63 stars 3 forks source link

Local/Remote Crash (DoS) in SET_CAR #74

Closed Halcy0nic closed 2 years ago

Halcy0nic commented 2 years ago

Hi!

Love the npl tool, I think it's super creative and really easy to use.

Brief Summary

While I was using the tool I had my fuzzer running in the background and came across a local/remote crash (DoS condition) as a result of slightly malformed input. Running the tool as a daemon/service (via inetd or some other means) would cause it to crash for all users accessing npl. The issue comes from invoking the SET_CAR function on an Atom when the input is malformed.

Reproduction

I've attached the input for reproduction purposes. After running npl against the input you can see following the GDB trace:

./npl -s ./input_file

gdb_nprolog_segfault

gdb_nprolog_set_car

Below is the hex dump of the input file: xxd_crash_nprolog

A similar process could be repeated for GET_CAR files.zip

sasagawa888 commented 2 years ago

Thank you for the bug report. I will consider how to deal with it.

sasagawa888 commented 2 years ago

I fixed it. I changed to consult/1 from reconsult/1 in -s mode.

tests/bug.pl .0.

npl -s tests/bug.pl Syntax error assertz .0 around here line=1 column=0 ?-

Halcy0nic commented 2 years ago

Sweet!

Thanks