René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Global Buffer Overflow Vulnerability","articleBody":"Detected Global Buffer Overflow Vulnerability in [src/explore_me/explore_me.cpp:40:3](https://github.com/CodeIntelligenceTesting/c-cpp-example/blob/e59b268352d4cd4d517418c7ff036d8937503770/src/explore_me/explore_me.cpp#L40)\r\n\r\nSEVERITY\r\n9.0\r\n\r\nDESCRIPTION\r\nA heap buffer overflow is a type of a memory corruption vulnerability that is widely used for different types of attacks. A successful heap buffer overflow attack can be used to read sensitive data in memory, or write and execute code in it.\r\n\r\nCWE\r\n[Heap-based Buffer Overflow (#122)](https://cwe.mitre.org/data/definitions/122.html)\r\n\r\nSTACKTRACE\r\n\r\n==11==ERROR: AddressSanitizer: global-buffer-overflow on address 0x560d21c1bba5 at pc 0x560d20e5955a bp 0x7ffe16fe96c0 sp 0x7ffe16fe8e90\r\nWRITE of size 8 at 0x560d21c1bba5 thread T0\r\n    #0 0x560d20e59559 in __asan_memcpy (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0x13e559) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #1 0x560d20e994b7 in trigger_global_buffer_overflow(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e const\u0026) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:40:3\r\n    #2 0x560d20e97707 in LLVMFuzzerTestOneInputNoReturn(unsigned char const*, unsigned long) /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/simple_checks_test.cpp:25:3\r\n    #3 0x560d20e97548 in LLVMFuzzerTestOneInput /home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/simple_checks_test.cpp:19:1\r\n    #4 0x560d20dbdb03 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0xa2b03) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #5 0x560d20dbd259 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0xa2259) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #6 0x560d20dbea49 in fuzzer::Fuzzer::MutateAndTestOne() (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0xa3a49) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #7 0x560d20dbf5c5 in fuzzer::Fuzzer::Loop(std::vector\u003cfuzzer::SizedFile, std::allocator\u003cfuzzer::SizedFile\u003e\u003e\u0026) (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0xa45c5) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #8 0x560d20dad702 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0x92702) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #9 0x560d20dd73f2 in main (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0xbc3f2) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n    #10 0x7f3855e2814f  (/lib/x86_64-linux-gnu/libc.so.6+0x2814f) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n    #11 0x7f3855e28208 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28208) (BuildId: 6a981b07a3731293c24c10a21397416d3c3d52ed)\r\n    #12 0x560d20da2144 in _start (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0x87144) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af)\r\n\r\n0x560d21c1bba5 is located 0 bytes to the right of global variable 'gBuffer' defined in '/home/runner/work/c-cpp-example/c-cpp-example/checkout-dir/src/explore_me/explore_me.cpp:37:6' (0x560d21c1bba0) of size 5\r\nSUMMARY: AddressSanitizer: global-buffer-overflow (/cifuzz/libfuzzer/address+undefined/simple_checks_fuzz_test/bin/src/explore_me/simple_checks_fuzz_test+0x13e559) (BuildId: ea922eefe4a4f20f33d93d3b043fed88f00889af) in __asan_memcpyShadow bytes around the buggy address:\r\n  0x0ac22437b720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=\u003e0x0ac22437b770: 00 f9 f9 f9[05]f9 f9 f9 00 00 00 00 00 00 00 00\r\n  0x0ac22437b780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b7a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b7b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x0ac22437b7c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==11==ABORTING\r\nMS: 1 CMP- DE: \"Attacker\"-; base unit: 5f0935f43e51f0c1a26d298c964eb0365b6f5390\r\n0x41,0x74,0x74,0x61,0x63,0x6b,0x65,0x72,0xff,0xff,0xf7,0xff,0xff,0xff,0xff,0xff,\r\nAttacker\\377\\377\\367\\377\\377\\377\\377\\377\r\nartifact_prefix='/tmp/libfuzzer-out-3182901598/'; Test unit written to /tmp/libfuzzer-out-3182901598/crash-d76ef491d7970a393dbafa6bfca19ec6872ff2f5\r\nBase64: QXR0YWNrZXL///f//////w==","author":{"url":"https://github.com/serj","@type":"Person","name":"serj"},"datePublished":"2024-03-26T12:02:08.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/12/c-cpp-example/issues/12"}