A heap-buffer-overflow was triggered by sqlcheck::CheckPattern

[Asteriska001]

Description

A heap-buffer-overflow was triggered by sqlcheck::CheckPattern(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits, std::allocator > const&, bool&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits > const&, sqlcheck::RiskLevel, sqlcheck::PatternType, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, std::__cxx11::basic_string<char, std::char_traits, std::allocator >, bool, unsigned long) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:239

Version

Ver. 1.3 Latest Commit

Environment

Ubuntu 18.04，64bit

Command

cmake .. && make && make install

ASAN

ASAN log.

==10335==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000078c58 at pc 0x55ba5c137801 bp 0x7ffc6fe570b0 sp 0x7ffc6fe570a0
READ of size 8 at 0x602000078c58 thread T0
    #0 0x55ba5c137800 in sqlcheck::CheckPattern(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> > const&, sqlcheck::RiskLevel, sqlcheck::PatternType, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool, unsigned long) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:239
    #1 0x55ba5c1af488 in sqlcheck::CheckFloat(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/list.cpp:373
    #2 0x55ba5c138c8d in sqlcheck::CheckStatement(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:331
    #3 0x55ba5c135143 in sqlcheck::Check(sqlcheck::Configuration&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:58
    #4 0x55ba5c13319d in main /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/main.cpp:124
    #5 0x7fdf7f8830b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #6 0x55ba5c1328bd in _start (/AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/build/bin/sqlcheck+0x8a8bd)

0x602000078c58 is located 0 bytes to the right of 8-byte region [0x602000078c50,0x602000078c58)
allocated by thread T0 here:
    #0 0x7fdf7feab5a7 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:99
    #1 0x55ba5c14f8ca in __gnu_cxx::new_allocator<unsigned long>::allocate(unsigned long, void const*) /usr/include/c++/10/ext/new_allocator.h:115
    #2 0x55ba5c14c800 in std::allocator_traits<std::allocator<unsigned long> >::allocate(std::allocator<unsigned long>&, unsigned long) /usr/include/c++/10/bits/alloc_traits.h:460
    #3 0x55ba5c149bd7 in std::_Vector_base<unsigned long, std::allocator<unsigned long> >::_M_allocate(unsigned long) /usr/include/c++/10/bits/stl_vector.h:346
    #4 0x55ba5c14434a in void std::vector<unsigned long, std::allocator<unsigned long> >::_M_realloc_insert<unsigned long>(__gnu_cxx::__normal_iterator<unsigned long*, std::vector<unsigned long, std::allocator<unsigned long> > >, unsigned long&&) (/AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/build/bin/sqlcheck+0x9c34a)
    #5 0x55ba5c1408a6 in void std::vector<unsigned long, std::allocator<unsigned long> >::emplace_back<unsigned long>(unsigned long&&) (/AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/build/bin/sqlcheck+0x988a6)
    #6 0x55ba5c13e245 in std::vector<unsigned long, std::allocator<unsigned long> >::push_back(unsigned long&&) (/AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/build/bin/sqlcheck+0x96245)
    #7 0x55ba5c1376d5 in sqlcheck::CheckPattern(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> > const&, sqlcheck::RiskLevel, sqlcheck::PatternType, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool, unsigned long) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:231
    #8 0x55ba5c1af488 in sqlcheck::CheckFloat(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/list.cpp:373
    #9 0x55ba5c138c8d in sqlcheck::CheckStatement(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:331
    #10 0x55ba5c135143 in sqlcheck::Check(sqlcheck::Configuration&) /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:58
    #11 0x55ba5c13319d in main /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/main.cpp:124
    #12 0x7fdf7f8830b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-buffer-overflow /AFLplusplus/my_test/sqlcheck/fuzzVal/sqlcheck/src/checker.cpp:239 in sqlcheck::CheckPattern(sqlcheck::Configuration&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, bool&, std::__cxx11::basic_regex<char, std::__cxx11::regex_traits<char> > const&, sqlcheck::RiskLevel, sqlcheck::PatternType, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, bool, unsigned long)
Shadow bytes around the buggy address:
  0x0c0480007130: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480007140: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480007150: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480007160: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c0480007170: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
=>0x0c0480007180: fa fa fd fa fa fa fd fa fa fa 00[fa]fa fa fa fa
  0x0c0480007190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800071a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800071b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800071c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c04800071d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==10335==ABORTING

Poc

Poc file.
id_000003,sig_06,src_000031+000605,time_52081908,execs_630523,op_splice,rep_16.zip