René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Heap Use After Free Vulnerability","articleBody":"Detected Heap Use After Free Vulnerability in [src/explore_me/explore_me.cpp:49:3](https://github.com/CodeIntelligenceTesting/c-cpp-example/blob/e59b268352d4cd4d517418c7ff036d8937503770/src/explore_me/explore_me.cpp#L49)\r\n\r\nSEVERITY\r\n8.0\r\n\r\nDESCRIPTION\r\nA heap use after free is the use of memory locations that has been allocated during the program execution then freed. For example, using attempting to use a pointer that has been freed. Accessing such locations have consequences that range from interrupting the execution to making the machine vulnerable to malicious code execution.\r\n\r\nCWE\r\n[Use After Free (#416)](https://cwe.mitre.org/data/definitions/416.html)\r\n\r\nSTACKTRACE\r\n```\r\n==11==ERROR: AddressSanitizer: heap-use-after-free on address 0x6020001daef0 at pc 0x558a4019f464 bp 0x7fffc6588ab0 sp 0x7fffc6588280\r\nREAD of size 3 at 0x6020001daef0 thread T0\r\n    #0 0x558a4019f463 in __interceptor_puts (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xd9463) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #1 0x558a402442fb in trigger_use_after_free() /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:49:3\r\n    #2 0x558a402442fb in ExploreComplexChecks(long, long, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:26:9\r\n    #3 0x558a40242719 in LLVMFuzzerTestOneInputNoReturn(unsigned char const*, unsigned long) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:25:3\r\n    #4 0x558a40242548 in LLVMFuzzerTestOneInput /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:19:1\r\n    #5 0x558a40168b03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2b03) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #6 0x558a40168259 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2259) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #7 0x558a40169a49 in fuzzer::Fuzzer::MutateAndTestOne() (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa3a49) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #8 0x558a4016a5c5 in fuzzer::Fuzzer::Loop(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e\u003e\u0026) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa45c5) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #9 0x558a40158702 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x92702) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #10 0x558a401823f2 in main (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xbc3f2) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #11 0x7fb5cf22814f  (/lib/x86_64-linux-gnu/libc.so.6+0x2814f) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n    #12 0x7fb5cf228208 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28208) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n    #13 0x558a4014d144 in _start (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x87144) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n\r\n0x6020001daef0 is located 0 bytes inside of 6-byte region [0x6020001daef0,0x6020001daef6)\r\nfreed by thread T0 here:\r\n    #0 0x558a40204ed2 in __interceptor_free (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x13eed2) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #1 0x558a402442f3 in trigger_use_after_free() /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:48:3\r\n    #2 0x558a402442f3 in ExploreComplexChecks(long, long, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:26:9\r\n    #3 0x558a40242719 in LLVMFuzzerTestOneInputNoReturn(unsigned char const*, unsigned long) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:25:3\r\n    #4 0x558a40242548 in LLVMFuzzerTestOneInput /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:19:1\r\n    #5 0x558a40168b03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2b03) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #6 0x558a40168259 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2259) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #7 0x558a40169a49 in fuzzer::Fuzzer::MutateAndTestOne() (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa3a49) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #8 0x558a4016a5c5 in fuzzer::Fuzzer::Loop(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e\u003e\u0026) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa45c5) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #9 0x558a40158702 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x92702) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #10 0x558a401823f2 in main (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xbc3f2) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #11 0x7fb5cf22814f  (/lib/x86_64-linux-gnu/libc.so.6+0x2814f) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n\r\npreviously allocated by thread T0 here:\r\n    #0 0x558a4020517e in malloc (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x13f17e) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #1 0x558a4024428d in trigger_use_after_free() /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:45:38\r\n    #2 0x558a4024428d in ExploreComplexChecks(long, long, std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:26:9\r\n    #3 0x558a40242719 in LLVMFuzzerTestOneInputNoReturn(unsigned char const*, unsigned long) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:25:3\r\n    #4 0x558a40242548 in LLVMFuzzerTestOneInput /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/complex_checks_test.cpp:19:1\r\n    #5 0x558a40168b03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2b03) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #6 0x558a40168259 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa2259) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #7 0x558a40169a49 in fuzzer::Fuzzer::MutateAndTestOne() (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa3a49) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #8 0x558a4016a5c5 in fuzzer::Fuzzer::Loop(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e\u003e\u0026) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xa45c5) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #9 0x558a40158702 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0x92702) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #10 0x558a401823f2 in main (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xbc3f2) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f)\r\n    #11 0x7fb5cf22814f  (/lib/x86_64-linux-gnu/libc.so.6+0x2814f) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n\r\nSUMMARY: AddressSanitizer: heap-use-after-free (/cifuzz/libfuzzer/address+undefined/complex_checks_fuzz_test/bin/src/explore_me/complex_checks_fuzz_test+0xd9463) (BuildId: 15d92887abe303fdf1a09f36d2634bd24c87c90f) in __interceptor_putsShadow bytes around the buggy address:\r\n  0x0c0480033580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c0480033590: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c04800335a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c04800335b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c04800335c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=\u003e0x0c04800335d0: fa fa fd fd fa fa fa fa fa fa fa fa fa fa[fd]fa\r\n  0x0c04800335e0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd\r\n  0x0c04800335f0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd\r\n  0x0c0480033600: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd\r\n  0x0c0480033610: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd\r\n  0x0c0480033620: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==11==ABORTING\r\nMS: 1 ChangeBit-; base unit: 13d8cd99d22b2dfbe23ab4dd6daac321c56374a0\r\n0x48,0x65,0x79,0x2c,0x20,0x77,0x65,0x6c,0x63,0x6f,0x6d,0x65,0x20,0x74,0x6f,0x20,0x43,0x49,0x20,0x46,0x75,0x7a,0x7a,0x21,\r\nHey, welcome to CI Fuzz!\r\nartifact_prefix='/tmp/libfuzzer-out-3565272225/'; Test unit written to /tmp/libfuzzer-out-3565272225/crash-65caedf1d4a69e866125573f33a835499c5aac7f\r\nBase64: SGV5LCB3ZWxjb21lIHRvIENJIEZ1enoh\r\n```","author":{"url":"https://github.com/serj","@type":"Person","name":"serj"},"datePublished":"2024-03-26T11:55:42.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/11/c-cpp-example/issues/11"}