GNU bug report logs - #33501
Malformed inputs triggering uninitialized memory use in inflate_dynamic()

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 33501 in the body.
You can then email your comments to 33501 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Hanno Böck <hanno <at> hboeck.de>
To: bug-gzip <at> gnu.org
Subject: Malformed inputs triggering uninitialized memory use in
 inflate_dynamic()
Date: Sun, 25 Nov 2018 16:45:18 +0100

Hi,

I did some testing of gzip with afl-fuzzing and memory sanitizer and it
ends up finding a use of uninitialized memory on some malformed inputs.

Sample input (base64):
H4sIADAwMDAwMGQAAAA=

With msan this causes:

==21601==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4affab in inflate_dynamic /f/gzip/gzip-1.9/inflate.c:803:9
    #1 0x4affab in inflate_block /f/gzip/gzip-1.9/inflate.c:925
    #2 0x4affab in inflate /f/gzip/gzip-1.9/inflate.c:957
    #3 0x4c805d in unzip /f/gzip/gzip-1.9/unzip.c:132:19
    #4 0x4a1234 in treat_file /f/gzip/gzip-1.9/gzip.c:1002:13
    #5 0x49d760 in main /f/gzip/gzip-1.9/gzip.c:670:13
    #6 0x7f85c3d724ea in __libc_start_main (/lib64/libc.so.6+0x244ea)
    #7 0x41c4d9 in _start (/r/gz/gzip+0x41c4d9)

You can reproduce by building gzip with clang+msan, e.g.
./configure CC=clang LD=clang CFLAGS="-fsanitize=undefined -U_FORTIFY_SOURCE" LDFLAGS="-fsanitize=undefined -U_FORTIFY_SOURCE"

And then run the above sample with gzip -dc.

(msan is incompatible with fortify source and some distros set it by
default, so it's better to unset it.)

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno <at> hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Message #8 received at 33501 <at> debbugs.gnu.org (full text, mbox):

From: "Adler, Mark" <madler <at> alumni.caltech.edu>
To: "33501 <at> debbugs.gnu.org" <33501 <at> debbugs.gnu.org>
Cc: Hanno Böck <hanno <at> hboeck.de>
Subject: Re: bug#33501: Malformed inputs triggering uninitialized memory use
 in	inflate_dynamic()
Date: Wed, 28 Nov 2018 21:09:45 +0000

This should fix it:

--- a/inflate.c
+++ b/inflate.c
@@ -799,6 +799,11 @@ inflate_dynamic(void)
     NEEDBITS((unsigned)bl)
     j = (td = tl + ((unsigned)b & m))->b;
     DUMPBITS(j)
+    if (td->e == 99)    /* invalid code */
+    {
+      huft_free(tl);
+      return 2;
+    }
     j = td->v.n;
     if (j < 16)                 /* length of code in bits (0..15) */
       ll[i++] = l = j;          /* save last length in l */

However I don’t have a memory sanitizer, so please verify. Thanks.

Mark


> On Nov 25, 2018, at 7:45 AM, Hanno Böck <hanno <at> hboeck.de> wrote:
> 
> Hi,
> 
> I did some testing of gzip with afl-fuzzing and memory sanitizer and it
> ends up finding a use of uninitialized memory on some malformed inputs.
> 
> Sample input (base64):
> H4sIADAwMDAwMGQAAAA=
> 
> With msan this causes:
> 
> ==21601==WARNING: MemorySanitizer: use-of-uninitialized-value
>    #0 0x4affab in inflate_dynamic /f/gzip/gzip-1.9/inflate.c:803:9
>    #1 0x4affab in inflate_block /f/gzip/gzip-1.9/inflate.c:925
>    #2 0x4affab in inflate /f/gzip/gzip-1.9/inflate.c:957
>    #3 0x4c805d in unzip /f/gzip/gzip-1.9/unzip.c:132:19
>    #4 0x4a1234 in treat_file /f/gzip/gzip-1.9/gzip.c:1002:13
>    #5 0x49d760 in main /f/gzip/gzip-1.9/gzip.c:670:13
>    #6 0x7f85c3d724ea in __libc_start_main (/lib64/libc.so.6+0x244ea)
>    #7 0x41c4d9 in _start (/r/gz/gzip+0x41c4d9)
> 
> You can reproduce by building gzip with clang+msan, e.g.
> ./configure CC=clang LD=clang CFLAGS="-fsanitize=undefined -U_FORTIFY_SOURCE" LDFLAGS="-fsanitize=undefined -U_FORTIFY_SOURCE"
> 
> And then run the above sample with gzip -dc.
> 
> (msan is incompatible with fortify source and some distros set it by
> default, so it's better to unset it.)
> 
> -- 
> Hanno Böck
> https://hboeck.de/
> 
> mail/jabber: hanno <at> hboeck.de
> GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
> 
> 
> 

Message #11 received at 33501 <at> debbugs.gnu.org (full text, mbox):

From: Hanno Böck <hanno <at> hboeck.de>
To: "Adler, Mark" <madler <at> alumni.caltech.edu>
Cc: "33501 <at> debbugs.gnu.org" <33501 <at> debbugs.gnu.org>
Subject: Re: bug#33501: Malformed inputs triggering uninitialized memory use
 in inflate_dynamic()
Date: Fri, 30 Nov 2018 15:28:01 +0100

On Wed, 28 Nov 2018 21:09:45 +0000
"Adler, Mark" <madler <at> alumni.caltech.edu> wrote:

> However I don’t have a memory sanitizer, so please verify. Thanks.

It's fixed with this patch.

(Also memory sanitizer is just a clang feature. While it's a bit
trickier to use in complex applications due to dependencies, for a
simple tool like gzip which only depends on libc it works pretty
straightforward.)

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno <at> hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Message #14 received at 33501 <at> debbugs.gnu.org (full text, mbox):

From: "Adler, Mark" <madler <at> alumni.caltech.edu>
To: Hanno Böck <hanno <at> hboeck.de>
Cc: "33501 <at> debbugs.gnu.org" <33501 <at> debbugs.gnu.org>
Subject: Re: bug#33501: Malformed inputs triggering uninitialized memory use
 in inflate_dynamic()
Date: Fri, 30 Nov 2018 17:02:05 +0000

My clang on macOS doesn’t support it.

> On Nov 30, 2018, at 6:28 AM, Hanno Böck <hanno <at> hboeck.de> wrote:
> 
> On Wed, 28 Nov 2018 21:09:45 +0000
> "Adler, Mark" <madler <at> alumni.caltech.edu> wrote:
> 
>> However I don’t have a memory sanitizer, so please verify. Thanks.
> 
> It's fixed with this patch.
> 
> (Also memory sanitizer is just a clang feature. While it's a bit
> trickier to use in complex applications due to dependencies, for a
> simple tool like gzip which only depends on libc it works pretty
> straightforward.)
> 
> -- 
> Hanno Böck
> https://hboeck.de/
> 
> mail/jabber: hanno <at> hboeck.de
> GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Message #19 received at 33501-done <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: "Adler, Mark" <madler <at> alumni.caltech.edu>
Cc: Hanno Böck <hanno <at> hboeck.de>, 33501-done <at> debbugs.gnu.org
Subject: Re: bug#33501: Malformed inputs triggering uninitialized memory use
 in inflate_dynamic()
Date: Fri, 30 Nov 2018 13:03:31 -0800

[Message part 1 (text/plain, inline)]

Thanks for the fix. I installed the attached patch into the GNU gzip 
master and am marking this bug as done.

[0001-gzip-fix-use-of-uninitialized-memory.patch (text/x-patch, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.