From e3e5b6422ac8c856e58f294d27e5a28a75d48023 Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Thu, 2 Sep 2021 10:27:41 +0200 Subject: [PATCH] zdump/dfi_s390: Fix out-of-bounds array access in df_s390_cpu_info_add() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verify that a s390 dump header contains a valid CPU count value. This bug was found with an input file produced by AFL + ASAN. $ ./zdump/zgetdump -i ~/input.bin ================================================================= ==3928488==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000001043e90 at pc 0x000001025dca bp 0x03ffe96fe128 sp 0x03ffe96fe120 READ of size 4 at 0x000001043e90 thread T0 #0 0x1025dc9 in df_s390_cpu_info_add /root/s390-tools/zdump/df_s390.c:57 #1 0x101bb59 in dfi_s390_init_gen /root/s390-tools/zdump/dfi_s390.c:169 #2 0x101bb59 in dfi_s390_init_gen /root/s390-tools/zdump/dfi_s390.c:156 #3 0x1015d23 in dfi_init /root/s390-tools/zdump/dfi.c:1216 #4 0x1006a0d in do_dump_info /root/s390-tools/zdump/zgetdump.c:127 #5 0x1006a0d in main /root/s390-tools/zdump/zgetdump.c:182 #6 0x3ffb93abe03 in __libc_start_main (/lib64/libc.so.6+0x2be03) #7 0x10077bd (/root/s390-tools/zdump/zgetdump+0x10077bd) 0x000001043e91 is located 0 bytes to the right of global variable 'l' defined in 'dfi_s390.c:30:3' (0x1042e80) of size 4113 SUMMARY: AddressSanitizer: global-buffer-overflow /root/s390-tools/zdump/df_s390.c:57 in df_s390_cpu_info_add Shadow bytes around the buggy address: 0x10000000208780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10000000208790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100000002087a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100000002087b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100000002087c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x100000002087d0: 00 00[01]f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x100000002087e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100000002087f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10000000208800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10000000208810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10000000208820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3928488==ABORTING Signed-off-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zdump/dfi_s390.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/zdump/dfi_s390.c b/zdump/dfi_s390.c index ea99daf7..1734f0ba 100644 --- a/zdump/dfi_s390.c +++ b/zdump/dfi_s390.c @@ -68,6 +68,8 @@ static int read_s390_hdr(void) return -ENODEV; if (l.hdr.magic != magic_number) return -ENODEV; + if (l.hdr.cpu_cnt > DF_S390_CPU_MAX) + return -ENODEV; df_s390_hdr_add(&l.hdr); return 0; }