Angband.oook.cz
Angband.oook.cz
AboutVariantsLadderForumCompetitionComicScreenshotsFunniesLinks

Go Back   Angband Forums > Angband > Vanilla

Reply
 
Thread Tools Display Modes
Old July 20, 2017, 06:56   #1
AndreyB
Scout
 
Join Date: May 2017
Location: Russia
Posts: 26
AndreyB is on a distinguished road
Buffer overflow in the keymap UI

Fedora 25
Angband 4.1.0 (sdl front end)
Probably reproducible on most other platforms and front ends.

If you create a keymap exactly 20 characters long, the code triggers a read past the end of the array.
It seams the UB is lying dormant. I spotted it using -fsanitize=undefined. Better kill it now before it comes for us.

How to reproduce:
1. recompile with -fsanitize=undefined
Code:
$ make clean
$ SANITIZE_FLAGS="-fsanitize=undefined -fsanitize=address" ./configure
$ SANITIZE_FLAGS="-fsanitize=undefined -fsanitize=address" make
2. create a keymap
3. enter 20 characters (maximum allowed)
4. -fsanitize=undefined crashes the game, printing the diagnostic:
Code:
==1845==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001090db0 at pc 0x000000696727 bp 0x7ffc2612be20 sp 0x7ffc2612be10
READ of size 4 at 0x000001090db0 thread T0
    #0 0x696726 in keypress_to_text /home/user/angband/src/ui-event.c:225
    #1 0x6e6b14 in ui_keymap_create /home/user/angband/src/ui-options.c:488
    #2 0x6c4a68 in menu_action_handle /home/user/angband/src/ui-menu.c:102
    #3 0x6cb9da in menu_handle_action /home/user/angband/src/ui-menu.c:661
    #4 0x6cd0a8 in menu_select /home/user/angband/src/ui-menu.c:797
    #5 0x6e7651 in do_cmd_keymaps /home/user/angband/src/ui-options.c:601
    #6 0x6c4a68 in menu_action_handle /home/user/angband/src/ui-menu.c:102
    #7 0x6cb9da in menu_handle_action /home/user/angband/src/ui-menu.c:661
    #8 0x6cd0a8 in menu_select /home/user/angband/src/ui-menu.c:797
    #9 0x6ee955 in do_cmd_options /home/user/angband/src/ui-options.c:1826
    #10 0x677a8c in do_cmd_xxx_options /home/user/angband/src/ui-command.c:138
    #11 0x697c89 in textui_process_command /home/user/angband/src/ui-game.c:313
    #12 0x697e02 in textui_get_cmd /home/user/angband/src/ui-game.c:325
    #13 0x698ccf in play_game /home/user/angband/src/ui-game.c:434
    #14 0x7679c4 in main /home/user/angband/src/main.c:524
    #15 0x7f841dba2400 in __libc_start_main (/lib64/libc.so.6+0x20400)
    #16 0x403769 in _start (/home/user/angband/src/angband+0x403769)

0x000001090db0 is located 0 bytes to the right of global variable 'keymap_buffer' defined in 'ui-options.c:377:24' (0x1090cc0) of size 240
0x000001090db0 is located 48 bytes to the left of global variable 'keymap_menu' defined in 'ui-options.c:574:21' (0x1090de0) of size 8
SUMMARY: AddressSanitizer: global-buffer-overflow /home/user/angband/src/ui-event.c:225 in keypress_to_text
Shadow bytes around the buggy address:
  0x00008020a160: 04 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
  0x00008020a170: 04 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
  0x00008020a180: 04 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
  0x00008020a190: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x00008020a1a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x00008020a1b0: 00 00 00 00 00 00[f9]f9 f9 f9 f9 f9 00 f9 f9 f9
  0x00008020a1c0: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x00008020a1d0: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9
  0x00008020a1e0: f9 f9 f9 f9 00 00 00 06 f9 f9 f9 f9 00 05 f9 f9
  0x00008020a1f0: f9 f9 f9 f9 00 02 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
  0x00008020a200: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1845==ABORTING
__________________
I like valgrind. it's the biggest timesaver people invented since the invention of the wheel.
UBSan&ASan are even better (no noticeable initialization delay on my machine).
I'm now playing with it on. WARNING: with UBSan&ASan panic saves don't seam to work.
AndreyB is offline   Reply With Quote
Reply

Tags
buffer overflow, bug report


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
tome2-ah: integer overflow in black market? Therem Harth Variants 5 September 1, 2014 23:36
YA keymap query Cromcruaich Vanilla 2 February 14, 2014 13:55
Tunnelling Keymap shinesei Vanilla 1 November 5, 2013 14:32
Keymap bug in 3.2.0? Therem Harth Vanilla 2 January 16, 2013 20:14
3.3.1 keymap bug? Chud Vanilla 7 September 27, 2011 10:43


All times are GMT +1. The time now is 19:08.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2017, vBulletin Solutions, Inc.