René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Modules/cjkcodecs/_codecs_iso2022.c - read out of bounds","articleBody":"# Bug report\r\n```\r\n==2729==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffef35c8f14 at pc 0x7f3e0254c47c bp 0x7ffef35c8e50 sp 0x7ffef35c8e48\r\nREAD of size 4 at 0x7ffef35c8f14 thread T0\r\n    #0 0x7f3e0254c47b in jisx0213_encoder Modules/cjkcodecs/_codecs_iso2022.c:808\r\n    #1 0x7f3e0254c47b in jisx0213_2004_1_encoder_paironly Modules/cjkcodecs/_codecs_iso2022.c:894\r\n    #2 0x7f3e025469a9 in iso2022_encode Modules/cjkcodecs/_codecs_iso2022.c:196\r\n    #3 0x7f3e02536457 in multibytecodec_encode Modules/cjkcodecs/multibytecodec.c:523\r\n    #4 0x7f3e0253829e in _multibytecodec_MultibyteCodec_encode_impl Modules/cjkcodecs/multibytecodec.c:620\r\n    #5 0x7f3e0253829e in _multibytecodec_MultibyteCodec_encode Modules/cjkcodecs/clinic/multibytecodec.c.h:91\r\n    #6 0x55e4cc690361 in cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:438\r\n    #7 0x55e4cc5b029e in PyObject_Call (/home/kali/Downloads/cpython/python+0x3e629e)\r\n    #8 0x55e4cc841026 in _PyCodec_EncodeInternal Python/codecs.c:419\r\n    #9 0x55e4cc9cb18f in _codecs_encode_impl Modules/_codecsmodule.c:132\r\n    #10 0x55e4cc9cb18f in _codecs_encode Modules/clinic/_codecsmodule.c.h:166\r\n    #11 0x55e4cc690361 in cfunction_vectorcall_FASTCALL_KEYWORDS Objects/methodobject.c:438\r\n    #12 0x55e4cc5af6bf in _PyObject_VectorcallTstate Include/internal/pycore_call.h:92\r\n    #13 0x55e4cc5af6bf in PyObject_Vectorcall Objects/call.c:301\r\n    #14 0x55e4cc4753f6 in _PyEval_EvalFrameDefault Python/generated_cases.c.h:2982\r\n    #15 0x55e4cc83c811 in _PyEval_EvalFrame Include/internal/pycore_ceval.h:88\r\n    #16 0x55e4cc83c811 in _PyEval_Vector Python/ceval.c:1716\r\n    #17 0x55e4cc83c811 in PyEval_EvalCode Python/ceval.c:578\r\n    #18 0x55e4cc91aebd in run_eval_code_obj Python/pythonrun.c:1702\r\n    #19 0x55e4cc91aebd in run_mod Python/pythonrun.c:1723\r\n    #20 0x55e4cc91e6ca in pyrun_file Python/pythonrun.c:1617\r\n    #21 0x55e4cc91e6ca in _PyRun_SimpleFileObject Python/pythonrun.c:439\r\n    #22 0x55e4cc91f17a in _PyRun_AnyFileObject Python/pythonrun.c:78\r\n    #23 0x55e4cc976719 in pymain_run_file_obj Modules/main.c:360\r\n    #24 0x55e4cc976719 in pymain_run_file Modules/main.c:379\r\n    #25 0x55e4cc976719 in pymain_run_python Modules/main.c:610\r\n    #26 0x55e4cc977ebc in Py_RunMain Modules/main.c:689\r\n    #27 0x55e4cc977ebc in pymain_main Modules/main.c:719\r\n    #28 0x55e4cc977ebc in Py_BytesMain Modules/main.c:743\r\n    #29 0x7f3e052d6209 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58\r\n    #30 0x7f3e052d62bb in __libc_start_main_impl ../csu/libc-start.c:389\r\n    #31 0x55e4cc49c3f0 in _start (/home/kali/Downloads/cpython/python+0x2d23f0)\r\n\r\nAddress 0x7ffef35c8f14 is located in stack of thread T0 at offset 52 in frame\r\n    #0 0x7f3e0254644f in iso2022_encode Modules/cjkcodecs/_codecs_iso2022.c:157\r\n\r\n  This frame has 2 object(s):\r\n    [48, 52) 'c' (line 161) \u003c== Memory access at offset 52 overflows this variable\r\n    [64, 72) 'length' (line 184)\r\nHINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork\r\n      (longjmp and C++ exceptions *are* supported)\r\nSUMMARY: AddressSanitizer: stack-buffer-overflow Modules/cjkcodecs/_codecs_iso2022.c:808 in jisx0213_encoder\r\nShadow bytes around the buggy address:\r\n  0x10005e6b1190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b11a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b11b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b11c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b11d0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1\r\n=\u003e0x10005e6b11e0: f1 f1[04]f2 00 f3 f3 f3 00 00 00 00 00 00 00 00\r\n  0x10005e6b11f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b1200: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 f3\r\n  0x10005e6b1210: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x10005e6b1220: 00 00 00 00 f1 f1 f1 f1 f8 f2 f2 f2 00 f2 f2 f2\r\n  0x10005e6b1230: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n  Shadow gap:              cc\r\n==2729==ABORTING\r\n```\r\n\r\n# Your environment\r\n\r\n\r\n- CPython versions tested on: 3.12, 3.11, 3.10\r\n- Operating system and architecture: x86_x64 NAME=\"Kali GNU/Linux\" \"2022.3\" (Reproduced also on other debian OS)\r\n\r\n# Steps to reproduce\r\n\r\n- CFLAGS=\"-fsanitize=address\" CXXFLAGS=\"-fsanitize=address\" LDFLAGS=\"-fsanitize=address\" ./configure\r\n- make\r\n- copy test.py and crashfile to /cpython directory\r\n- run ./python test.py\r\n# Prerequisites\r\n[crashfile.txt](https://github.com/python/cpython/files/10464270/crashfile.txt)\r\ntest.py\r\n```\r\nimport codecs\r\nf=open('crashfile.txt', 'r')\r\ntext=f.read()\r\nprint(text)\r\ncodecs.encode(text, encoding='iso2022_jp_2004', errors='ignore')\r\n```\r\n\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-101720\n* gh-111695\n* gh-111769\n* gh-111771\n* gh-111779\n* gh-111780\n* gh-111781\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/stasos24","@type":"Person","name":"stasos24"},"datePublished":"2023-01-20T07:58:02.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":8},"url":"https://github.com/101180/cpython/issues/101180"}