Package: e2fsprogs
Version: 1.43.6-1

$ gzip -d oob.ext2.gz
$ valgrind -q /sbin/debugfs -R ls oob.ext2 > /dev/null
debugfs 1.43.6 (29-Aug-2017)
==9681== Invalid read of size 4
==9681==    at 0x486E2F0: crc32_body (crc32c.c:116)
==9681==    by 0x486E2F0: crc32_le_generic (crc32c.c:180)
==9681==    by 0x486E2F0: ext2fs_crc32c_le (crc32c.c:188)
==9681==    by 0x486EA8A: ext2fs_inode_csum.isra.10 (csum.c:651)
==9681==    by 0x486F573: ext2fs_inode_csum_verify (csum.c:674)
==9681==    by 0x48826A0: ext2fs_read_inode_full (inode.c:821)
==9681==    by 0x4882774: ext2fs_read_inode (inode.c:845)
==9681==    by 0x114DD5: debugfs_read_inode (util.c:441)
==9681==    by 0x1163D1: do_list_dir (ls.c:245)
==9681==    by 0x48C3215: check_request_table (execute_cmd.c:105)
==9681==    by 0x48C3215: really_execute_command (execute_cmd.c:143)
==9681==    by 0x48C33EA: ss_execute_line (execute_cmd.c:224)
==9681==    by 0x10E216: main (debugfs.c:2553)
==9681==  Address 0x4b07fa8 is 0 bytes after a block of size 128 alloc'd
==9681==    at 0x482E2BC: malloc (in 
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9681==    by 0x4881512: ext2fs_get_mem (ext2fs.h:1741)
==9681==    by 0x4881512: ext2fs_create_inode_cache (inode.c:125)
==9681==    by 0x48826F6: ext2fs_read_inode_full (inode.c:759)
==9681==    by 0x4882774: ext2fs_read_inode (inode.c:845)
==9681==    by 0x114DD5: debugfs_read_inode (util.c:441)
==9681==    by 0x1163D1: do_list_dir (ls.c:245)
==9681==    by 0x48C3215: check_request_table (execute_cmd.c:105)
==9681==    by 0x48C3215: really_execute_command (execute_cmd.c:143)
==9681==    by 0x48C33EA: ss_execute_line (execute_cmd.c:224)
==9681==    by 0x10E216: main (debugfs.c:2553)
...


Found using American Fuzzy Lop:
http://lcamtuf.coredump.cx/afl/

-- System Information:
Architecture: i386

Versions of packages e2fsprogs depends on:
ii  e2fslibs    1.43.6-1
ii  libblkid1   2.29.2-5+b1
ii  libc6       2.24-17
ii  libcomerr2  1.43.6-1
ii  libss2      1.43.6-1
ii  libuuid1    2.29.2-5+b1

--
Jakub Wilk

Attachment: oob.ext2.gz
Description: application/gzip

Reply via email to