Re: svn commit: r1927937 - in apr/apr/trunk: . test uri

On 8/24/25 1:19 PM, Ruediger Pluem wrote:
> 
> 
> On 8/24/25 12:37 PM, Eric Covener wrote:
>> On Sun, Aug 24, 2025 at 6:20 AM Ruediger Pluem <[email protected]> wrote:
>>>
>>>
>>>
>>> On 8/23/25 5:43 PM, Eric Covener wrote:
>>>> crashing in OSS fuzz of httpd (I guess it uses apr-trunk)
>>>>
>>>> ssipuuO://[  ]:             %25                                   ˇˇ
>>>
>>> Can you provide more details about this failure? Which test fails exactly?
>>
>> I am not sure, there seems to be a failure for both fuzzing httpd APIS
>> and the APR APis directly.
>> Presumably the APR tests look a like the unit tests.
>>
>> Null-dereference READ Fri, Aug 22, 2025, 7:29 AM Project apache-httpd
>> Platform linux Reliably reproduces Security
>> apr_uri_parse
>> ap_parse_uri
>> ap_assign_request_line
>> Issue 440585445
>> Null-dereference READ Fri, Aug 22, 2025, 3:39 AM Project apache-httpd
>> Platform linux Reliably reproduces Security
>> apr_uri_parse
>> fuzz_uri.c
>>
>>
>> UndefinedBehaviorSanitizer:DEADLYSIGNAL
>> ==400==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address
>> 0x000000000003 (pc 0x7e04e9cf4a80 bp 0x7fff5b49b390 sp 0x7fff5b49b328
>> T400)
>> ==400==The signal is caused by a READ memory access.
>> ==400==Hint: address points to the zero page.
>> #0 0x7e04e9cf4a80 in memmove-vec-unaligned-erms.S:383
>> /build/glibc-LcI20x/glibc-2.31/sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:383
>> #1 0x5ae658fb6116 in percent_decode_scope_zone_id
>> httpd/srclib/apr/uri/apr_uri.c:124:5
>> #2 0x5ae658fb6116 in apr_uri_parse httpd/srclib/apr/uri/apr_uri.c:986:13
>> #3 0x5ae658ec970d in LLVMFuzzerTestOneInput /src/fuzz_uri.c:54:9
>>
> 
> Thanks. Can you please check if the following patch causes the crash to go away?
> 
> Index: uri/apr_uri.c
> ===================================================================
> --- uri/apr_uri.c	(revision 1927952)
> +++ uri/apr_uri.c	(working copy)
> @@ -945,9 +945,17 @@
>           * unescape that.
>           */
>          if (*hostinfo == '[') {
> +            apr_status_t err;
> +
> +            v6_offset1 = 1;
> +            v6_offset2 = 2;
> +            s = memchr(hostinfo, ']', uri - hostinfo);
> +            if (s == NULL) {
> +                return APR_EGENERAL;
> +            }
> +
>              /* zone identifier */
> -            apr_status_t err = detect_scope_zone_id(&have_zone_id, hostinfo,
> -                                                    uri - hostinfo);
> +            err = detect_scope_zone_id(&have_zone_id, hostinfo + 1, s - hostinfo - 1);
>              /* FIXME: Ignore APR_EINVAL (invalid escaped character) for now as
>               * old code may rely on it silently getting ignored?
>               */
> @@ -956,12 +964,6 @@
>              }
> 
>              /* Port */
> -            v6_offset1 = 1;
> -            v6_offset2 = 2;
> -            s = memchr(hostinfo, ']', uri - hostinfo);
> -            if (s == NULL) {
> -                return APR_EGENERAL;
> -            }
>              if (*++s != ':') {
>                  s = NULL; /* no port */
>              }
> 

Committed as r1928016.

Regards

Rüdiger