yhirose
commented
4 years ago @seviezhou, thanks for the feedback. Could you give me more detailed information about it? Thanks!
Closed seviezhou closed 4 years ago
yhirose
commented
4 years ago @seviezhou, thanks for the feedback. Could you give me more detailed information about it? Thanks!
seviezhou
commented
4 years ago Well, this bug is found by fuzzing. I compiled the code with Address Sanitizer and mutate the pl0.peg sample file in the project. I use this command to execute the program. After some mutation, I got this crash, I think you can reproduce it using the command and input I give.
I am sorry, I am not very familiar with the project code, so I cannot analyze the actually cause of this bug.
yhirose
commented
4 years ago @seviezhou, ok. How did you mutate the pl0.peg?
seviezhou
commented
4 years ago Just some randomly bit/byte flipping, or substitute some parts of inputs with a set of predefined strings.
yhirose
commented
4 years ago @seviezhou, does it mean that the mutated file is no longer a valid text UTF-8 file?
seviezhou
commented
4 years ago It is possible that some part of the mutated file is not valid text file, but for this case, you can see that most of the content is still text, and the bug was triggered by these text content:
program <- _ block '.' _
block <- const var procedure statement
const <- ('CONST' __ ident '=' _ number (',' _ ident '=' _ number)* ';' _)?
var <- ('VAR' __ ident (',' _ ident)* ';' _)?
procedure <- ('PROCEDURE' __ ident ';' _ block ';' _)*
statement <- (assignment / call / statements / if / while / out / in)?
assignment <- ident ':=' _ expression
call <- 'CALL' __ ident
statements <- 'BEGIN' __ statement (';' _ statement )* 'END' __
if <- 'IF' __ condition 'THEN' __ statement
while <- 'WHILE' __ condition 'DO' __ statement
out <- ('out' __ / 'write' __ / '!' _) expression
in <- ('in' __ / 'read' __ / '?' _) ident
condition <- odd / compare
odd <- 'ODD' __ expression
compare <- expression compare_op expression
compare_op <- < '=' / '#' / '<=' / '<' / '>=' / '>' > _
expression <- sign term (term_op term)*
sign <- < [-+]? > _
term_op <- < [-+] > _
term <- factor (factor_op factor)*
factor_op <- < [*/] > _
factor <- ident / number / '(' _ expression ')' _
ident <- < [a-z] [a-z0-9]* > _
number <- < [0-9]+ > _
~_ <- [ \t\r\n]*
~__ <- 
fgeek
commented
3 years ago CVE-2020-23915 has been assigned for this issue.
System info
Ubuntu x86_64, gcc (Ubuntu 5.5.0-12ubuntu1), peglint (latest master 14305f)
Configure
cmake .. -DCMAKE_CXX_FLAGS="-fsanitize=address -g" -DCMAKE_C_FLAGS="-fsanitize=address -g" -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
Command line
./build/lint/peglint --ast --opt ./heap-overflow-resolve_escape_sequence-peglib-347 ./pl0/samples/fib.pas
AddressSanitizer output
POC
heap-overflow-resolve_escape_sequence-peglib-347.zip