Bug 1649175 - There is a heap-buffer-overflow at slaxlexer.c:1102(funtion:slaxLexer) in libslax latest version that will bring serious impact to Juniper
Summary: There is a heap-buffer-overflow at slaxlexer.c:1102(funtion:slaxLexer) in lib...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-13 04:12 UTC by shuitao gan
Modified: 2018-11-13 14:47 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-13 14:47:06 UTC


Attachments (Terms of Use)
./slaxproc --slax-to-xslt POC0 (3.27 KB, application/x-fluid)
2018-11-13 04:12 UTC, shuitao gan
no flags Details

Description shuitao gan 2018-11-13 04:12:49 UTC
Created attachment 1505093 [details]
./slaxproc  --slax-to-xslt  POC0

version: libslax latest version (commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5 Commits on Sep 1, 2018)

Summary: 

There is a heap-buffer-overflow at slaxlexer.c:601(funtion:slaxGetInput) in libslax that will will bring serious impact to 
Juniper.

Description:

The asan debug is as follows:

$./slaxproc  --slax-to-xslt  POC0
=================================================================
==123476==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62500000e900 at pc 0x7f13757a3e15 bp 0x7fff08d45840 sp 
0x7fff08d45830
READ of size 1 at 0x62500000e900 thread T0
    #0 0x7f13757a3e14 in slaxLexer ../../libslax/slaxlexer.c:1102
    #1 0x7f13757a4e3c in slaxYylex ../../libslax/slaxlexer.c:1267
    #2 0x7f13757aefbb in slaxParse /home/company/real_sanitize/libslax-master/build/libslax/slaxparser.c:2447
    #3 0x7f13757a881a in slaxLoadFile ../../libslax/slaxloader.c:731
    #4 0x406429 in do_slax_to_xslt ../../slaxproc/slaxproc.c:156
    #5 0x402c86 in main ../../slaxproc/slaxproc.c:1039
    #6 0x7f137499ba3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #7 0x4041a8 in _start (/home/company/real_sanitize/libslax-master/build/slaxproc/.libs/lt-slaxproc+0x4041a8)

0x62500000e900 is located 0 bytes to the right of 8192-byte region [0x62500000c900,0x62500000e900)
allocated by thread T0 here:
    #0 0x7f1375aafd2a in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98d2a)
    #1 0x7f13757a1dec in slaxGetInput ../../libslax/slaxlexer.c:601

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../libslax/slaxlexer.c:1102 slaxLexer
Shadow bytes around the buggy address:
  0x0c4a7fff9cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c4a7fff9d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c4a7fff9d20:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4a7fff9d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==123476==ABORTING

Comment 1 Andrej Nemec 2018-11-13 14:47:06 UTC
Hello,

Red Hat does not ship libslax in any of our supported products. Please, report these issues upstream at:

https://github.com/Juniper/libslax

Thanks!


Note You need to log in before you can comment on or make changes to this bug.