Bug 2058212

Created attachment 1863189 [details]
poc

Description of problem: nasm's disasm has a stack-overflow in disasm.c:377 function do_ea.

Version-Release number of selected component (if applicable): latest commit 3f9fc2a3a7134936cbbae5780beb4319694f702a


How reproducible:
export CFLAGS="-fsanitize=address -g"
export CC=clang
./autogen.sh
./configure --disable-shared
make -j8
./ndisasm ./stack_overflow.1

==1251159==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd083b8240 at pc 0x0000004d51e6 bp 0x7ffd083b5d60 sp 0x7ffd083b5d58
READ of size 1 at 0x7ffd083b8240 thread T0
    #0 0x4d51e5 in do_ea /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38
    #1 0x4cf302 in matches /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:675:20
    #2 0x4ca0a0 in disasm /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:1345:23
    #3 0x4c471b in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:323:22
    #4 0x7f9603c7efcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7f9603c7f07c in __libc_start_main csu/../csu/libc-start.c:409:3
    #6 0x41c2d4 in _start (/home/kdsj/workspace/benchmarks/reproduce/nasm/ndisasm+0x41c2d4)

Address 0x7ffd083b8240 is located in stack of thread T0 at offset 96 in frame
    #0 0x4c278f in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:84

  This frame has 6 object(s):
    [32, 96) 'buffer' (line 85) <== Memory access at offset 96 overflows this variable
    [128, 136) 'ep' (line 85)
    [160, 416) 'outbuf' (line 86)
    [480, 484) 'synclen' (line 89)
    [496, 516) 'prefer' (line 95)
    [560, 561) 'rn_error' (line 96)
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38 in do_ea
Shadow bytes around the buggy address:
  0x10002106eff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f030: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
=>0x10002106f040: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 00 f2 f2 f2
  0x10002106f050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f070: f2 f2 f2 f2 f2 f2 f2 f2 04 f2 00 00 04 f2 f2 f2
  0x10002106f080: f2 f2 01 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002106f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb


Additional info:

This bug is reported by nipc(http://www.nipc.org.cn/).