On Thu, Jun 15, 2017 at 09:42:41AM -0500, Eduardo Bustamante wrote:
> Found by fuzzing `read -e' with AFL. The stacktrace reported by Address
> Sanitizer is followed by the base64 encoded crashing input.
>
>
> ==11018==ERROR: AddressSanitizer: heap-buffer-overflow on address
> 0x60700000ccc0 at pc 0x559bb60f1be7 bp 0x7ffc36ec8710 sp 0x7ffc36ec8708
> READ of size 8 at 0x60700000ccc0 thread T0
> #0 0x559bb60f1be6 in _rl_copy_to_kill_ring
> (/home/dualbus/src/gnu/bash-build/bash+0x23cbe6)
Easy fix. When `rl_kill_ring_length == rl_max_kills (10)', all of the entries
in the kill ring are shifted. The loop has an off-by-one error though.
I also think that using `rl_max_kills' in the loop instead of `slot' makes the
code easier to read.
dualbus@debian:~/src/gnu/bash$ git difftool -y -x 'diff -c' --
lib/readline/kill.c
*** /tmp/uLCFvH_kill.c 2017-06-16 10:04:43.472930262 -0500
--- lib/readline/kill.c 2017-06-16 10:04:20.048344312 -0500
***************
*** 113,119 ****
{
register int i;
xfree (rl_kill_ring[0]);
! for (i = 0; i < slot; i++)
rl_kill_ring[i] = rl_kill_ring[i + 1];
}
else
--- 113,119 ----
{
register int i;
xfree (rl_kill_ring[0]);
! for (i = 0; i < rl_max_kills - 1; i++)
rl_kill_ring[i] = rl_kill_ring[i + 1];
}
else
--
Eduardo Bustamante
https://dualbus.me/
