Hi, we recently found an invalid memory access parsing and executing fuzzed bash code in GNU Bash 4.4.0 (bash-20160826 snapshot, found in http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=79eedac429c5112ae65a430674de5e4be1cd5444 ). We tested this issue on Ubuntu 14.04.5 (x86_64) but other configurations could be affected. To reproduce it, compilation with Address Sanitizer is required:
$ ./configure --without-bash-malloc CFLAGS=-fsanitize=address -g -ggdb LDFLAGS=-fsanitize=address $ make Technical details about the issue are: ==25874== ERROR: AddressSanitizer: heap-use-after-free on address 0x60040000b9f0 at pc 0x437f17 bp 0x7fff4b7aaa80 sp 0x7fff4b7aaa78 READ of size 1 at 0x60040000b9f0 thread T0 And gdb backtrace is as follows: [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGABRT, Aborted. 0x00007ffff468fc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #0 0x00007ffff468fc37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007ffff4693028 in __GI_abort () at abort.c:89 #2 0x00007ffff4e66829 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0 #3 0x00007ffff4e5d3ec in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0 #4 0x00007ffff4e64012 in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.0 #5 0x00007ffff4e63121 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.0 #6 0x00007ffff4e5d6a4 in __asan_report_load1 () from /usr/lib/x86_64-linux-gnu/libasan.so.0 #7 0x0000000000437f17 in parse_comsub (qc=0, open=40, close=41, lenp=0x7fffffffd7f0, flags=8) at ./parse.y:3926 #8 0x000000000043d057 in read_token_word (character=62) at ./parse.y:4854 #9 0x0000000000434e4d in read_token (command=0) at ./parse.y:3296 #10 0x0000000000432e7f in yylex () at ./parse.y:2675 #11 0x0000000000425a45 in yyparse () at y.tab.c:1832 #12 0x0000000000424e6b in parse_command () at eval.c:261 #13 0x0000000000424f72 in read_command () at eval.c:305 #14 0x0000000000424b20 in reader_loop () at eval.c:149 #15 0x0000000000420681 in main (argc=2, argv=0x7fffffffed28, env=0x7fffffffed40) at shell.c:792 This issue was found using QuickFuzz, the file to reproduce it is attached. Regards.
-799646324984424118.iftlnsqdux.sh
Description: Bourne shell script
