Bug 1484274

Created attachment 1316974 [details]
Triggered by " ./tic POC7 "

Description of problem:

There is an infinite loop in comp_scan.c of libncurses. 

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./tic POC7

Steps to Reproduce:


$ ./tic POC7
"fuzz/info2cap_output/crashes/id:000000,sig:11,src:000041,op:havoc,rep:32", line 1, col 9, terminal 'a+du1': Illegal character (expected alphanumeric or @%&*!#) - '/'
"fuzz/info2cap_output/crashes/id:000000,sig:11,src:000041,op:havoc,rep:32", line 2, col 18, terminal 'a+du1': Illegal character (expected alphanumeric or @%&*!#) - '/'


The GDB debugging information is as follows:

(gdb) r
...
Breakpoint 2, next_char () at ../ncurses/./tinfo/comp_scan.c:209
209			if (fgets(result + used, (int) (allocated - used), yyin) != 0) {
(gdb) bt 
#0  next_char () at ../ncurses/./tinfo/comp_scan.c:209
#1  0x000000000043fa3d in _nc_get_token (silent=false) at ../ncurses/./tinfo/comp_scan.c:392
#2  0x0000000000442a20 in _nc_parse_entry (entryp=0x7fffffffaf48, literal=0, silent=false)
    at ../ncurses/./tinfo/parse_entry.c:216
#3  0x000000000043db23 in _nc_read_entry_source (fp=<optimized out>, buf=<optimized out>, literal=0, silent=false, 
    hook=0x40e230 <immedhook>) at ../ncurses/./tinfo/comp_parse.c:225
#4  0x0000000000403039 in main (argc=<optimized out>, argv=<optimized out>) at ../progs/tic.c:958
...

The vulnerability was triggered in function:
next_char () at ../ncurses/./tinfo/comp_scan.c:223
223			if ((bufptr = bufstart) != 0) {

Code:
194		do {
195		    size_t used = 0;
196		    bufstart = 0;
197		    do {
198			if (used + (LEXBUFSIZ / 4) >= allocated) {
199			    allocated += (allocated + LEXBUFSIZ);
200			    result = typeRealloc(char, allocated, result);
201			    if (result == 0)
202				return (EOF);
203			    if (bufstart)
204				bufstart = result;
205			}
206			if (used == 0)
207			    _nc_curr_file_pos = ftell(yyin);
208	
209			if (fgets(result + used, (int) (allocated - used), yyin) != 0) {
210			    bufstart = result;
211			    if (used == 0) {
212				if (_nc_curr_line == 0
213				    && IS_TIC_MAGIC(result)) {
214				    _nc_err_abort("This is a compiled terminal description, not a source");
215				}
216				_nc_curr_line++;
217				_nc_curr_col = 0;
218			    }
219			} else {
220			    if (used != 0)
221				_nc_STRCAT(result, "\n", allocated);
222			}
223			if ((bufptr = bufstart) != 0) {
224			    used = strlen(bufptr);
225			    while (iswhite(*bufptr)) {
226				if (*bufptr == '\t') {
227				    _nc_curr_col = (_nc_curr_col | 7) + 1;
228				} else {
229				    _nc_curr_col++;
230				}
231				bufptr++;
232			    }
233	
234			    /*
235			     * Treat a trailing <cr><lf> the same as a <newline> so we
236			     * can read files on OS/2, etc.
237			     */
238			    if ((len = strlen(bufptr)) > 1) {
239				if (bufptr[len - 1] == '\n'
240				    && bufptr[len - 2] == '\r') {
241				    len--;
242				    bufptr[len - 1] = '\n';
243				    bufptr[len] = '\0';
244				}
245			    }
246			} else {
247			    return (EOF);
248			}
249		    } while (bufptr[len - 1] != '\n');	/* complete a line */
250		} while (result[0] == '#');	/* ignore comments */
251	    } else if (*bufptr == '\t') {

Actual results:

crash

Expected results:

crash

Additional info:

Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao   and chaoz.cn if you need more info about the team, the tool or the vulnerability.