[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 09 Feb 2017 14:50:18 +0100
From: Agostino Sarubbo <ago@...too.org>
To: oss-security@...ts.openwall.com
Subject: zziplib: load of misaligned address in memdisk.c
Description:
zziplib is an intentionally lightweight library that offers the ability to
easily extract data from files archived in a single zip file.
A fuzz on it discovered the load of a misaligned address. It can cause
undefined behavior.
The complete ASan output:
# unzzipcat-mem $FILE
/tmp/portage/dev-libs/zziplib-0.13.62-
r1/work/zziplib-0.13.62/zzip/memdisk.c:250:33: runtime error: load of
misaligned address 0x00000295d17d for type 'uint16_t' (aka 'unsigned short'),
which requires 2 byte alignment
0x00000295d17d: note: pointer points here
5a 45 93 58 75 70 0b 00 00 61 64 0a 50 4b 01 02 1e 03 0a 00 00 00 00 ff ff
ff ff 42 00 00 00 b1
^
/tmp/portage/dev-libs/zziplib-0.13.62-
r1/work/zziplib-0.13.62/zzip/memdisk.c:256:22: runtime error: load of
misaligned address 0x00000295d17f for type 'uint16_t' (aka 'unsigned short'),
which requires 2 byte alignment
0x00000295d17f: note: pointer points here
93 58 75 70 0b 00 00 61 64 0a 50 4b 01 02 1e 03 0a 00 00 00 00 ff ff ff ff
42 00 00 00 b1 01 00
^
Affected version:
0.13.62
Fixed version:
N/A
Commit fix:
N/A
Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.
CVE:
N/A
Reproducer:
https://github.com/asarubbo/poc/blob/master/00160-zziplib-misalignedadd-memdisk_c
Timeline:
2017-01-17: bug discovered and poked upstream
2017-02-09: blog post about the issue
Note:
This bug was found with American Fuzzy Lop.
Permalink:
https://blogs.gentoo.org/ago/2017/02/09/zziplib-load-of-misaligned-address-in-memdisk-c
--
Agostino Sarubbo
Gentoo Linux Developer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
