search

theZiz / aha

Ansi HTML Adapter
Other
907 stars 88 forks source link

aha: Buffer overflow in main function at aha.c:973 in aha 0.5.1 allows remote attackers to cause a denial of service (crash) via a crafted input document. #95

Open JieyongMa opened 2 years ago

JieyongMa commented 2 years ago

root@fuzz06:/home/fuzz/fuzz/aha-master# gdb --args ./aha -f out/fuzzer1/crashes/poc.txt GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.1) 9.2 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/. Find the GDB manual and other documentation resources online at: http://www.gnu.org/software/gdb/documentation/.

For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from ./aha... (gdb) r Starting program: /home/fuzz/fuzz/aha-master/aha -f out/fuzzer1/crashes/poc.txt <?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

out/fuzzer1/crashes/poc.txt 

Program received signal SIGSEGV, Segmentation fault.
0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
973                             momelem=momelem->next;
(gdb) bt
#0  0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973
(gdb) l
968                                         state.highlighted = 1;
969                                         *dest=momelem->value-100;
970                                     }
971                                     break;
972                             }
973                             momelem=momelem->next;
974                         }
975                         deleteParse(elem);
976                     break;
977                     case 'H':
(gdb) n

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.

[poc.txt](https://github.com/theZiz/aha/files/8331543/poc.txt)