Re: Buffer Overflow in cmd_load
Antonio Ceballos <[email protected]> Wed, 21 Aug 2019 10:29:18 +0200
| Newsgroups | gmane.comp.gnu.chess.bugs |
|---|---|
| Message-ID | <CAO7R9g9uhNP5Xjm7-bXPNCf8tiSECWnpO2xdHh9hhqxq+5uaBw@mail.gmail.com> |
--===============7896786533259136423== Content-Type: multipart/alternative; boundary="0000000000002b761305909c5f83" --0000000000002b761305909c5f83 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Henry, Thanks for your report. The details you provide are very much appreciated. I see the bug you pinpoint and I will fix it for the next release of GNU Chess. Regards, Antonio Ceballos On Wed, Aug 14, 2019 at 4:48 PM Henry Ballentine via Bug-gnu-chess < [email protected]> wrote: > Hello, > > I found a stack buffer overflow in the cmd_load function in > frontend/cmd.cc lines 318-322 in gnuchess 6.2.5. This occurs when trying = to > copy the contents of the loaded file to send to the game engine. > > 318 while ( epdline[i] !=3D '\n' ) { > > 319 data[i+9] =3D epdline[i]; > > 320 ++i; > > 321 printf("%d %c 0x%X\n", i, data[i+9], epdline[i]); > > 322 } > > When parsing a valid file with no endlines in it, if the filename is too > long it overflows the data buffer because the copying while loop is looki= ng > for newlines, not nulls to terminate the loop. For example, inputting: > > load > /path/to/input/file/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtest2 > > File contents: > > r5k1/p1p3p1/3bqr2/3pN2p/3ppB2/P7/1P3P1Q/R3R1K1 b - - bm 1; id > 1;\8Ar5kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=E2=80=A6 (~1= 6Kb of A) > > Results in a stack where epdline has overflown into the buffer for > handling user input, the base pointer, and the return address on the stac= k. > > Regards, > > Henry Ballentine > > > _______________________________________________ > Bug-gnu-chess mailing list > [email protected] > https://lists.gnu.org/mailman/listinfo/bug-gnu-chess > --0000000000002b761305909c5f83 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div class=3D"gmail_default" style=3D"font-size:small">Hi = Henry,</div><div class=3D"gmail_default" style=3D"font-size:small"><br></di= v><div class=3D"gmail_default" style=3D"font-size:small">Thanks for your re= port. The details you provide are very much appreciated. I see the bug you = pinpoint and I will fix it for the next release of GNU Chess.</div><div cla= ss=3D"gmail_default" style=3D"font-size:small"><br></div><div class=3D"gmai= l_default" style=3D"font-size:small">Regards,</div><div class=3D"gmail_defa= ult" style=3D"font-size:small">Antonio Ceballos<br></div><div class=3D"gmai= l_default" style=3D"font-size:small"><br></div></div><br><div class=3D"gmai= l_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Aug 14, 2019 at 4:48= PM Henry Ballentine via Bug-gnu-chess <<a href=3D"mailto:bug-gnu-chess@= gnu.org">[email protected]</a>> wrote:<br></div><blockquote class=3D= "gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2= 04,204,204);padding-left:1ex"><p dir=3D"ltr" style=3D"line-height:1.38;marg= in-top:0pt;margin-bottom:0pt">Hello,</p><div dir=3D"ltr"><br></div><div dir= =3D"ltr"><span style=3D"background-color:transparent"><span style=3D"color:= rgb(0,0,0)"><span style=3D"font-family:"Times New Roman""><span s= tyle=3D"font-size:12pt">I found a stack buffer overflow in the cmd_load fun= ction in frontend/cmd.cc lines 318-322 in gnuchess 6.2.5. This occurs when = trying to copy the contents of the loaded file to send to the game engine.= =C2=A0</span></span></span></span><br></div><div><br></div><p dir=3D"ltr" s= tyle=3D"line-height:1.62857;margin-top:0pt;margin-bottom:0pt"><span style= =3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><sp= an style=3D"font-family:"Courier New""><span style=3D"font-size:1= 0.5pt">318 =C2=A0 =C2=A0 =C2=A0 </span></span></span></span><span style=3D"= background-color:rgb(0,0,0)"><span style=3D"color:rgb(197,134,192)"><span s= tyle=3D"font-family:"Courier New""><span style=3D"font-size:10.5p= t">while</span></span></span></span><span style=3D"background-color:rgb(0,0= ,0)"><span style=3D"color:rgb(212,212,212)"><span style=3D"font-family:&quo= t;Courier New""><span style=3D"font-size:10.5pt"> ( </span></span></sp= an></span><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:= rgb(156,220,254)"><span style=3D"font-family:"Courier New""><span= style=3D"font-size:10.5pt">epdline</span></span></span></span><span style= =3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><sp= an style=3D"font-family:"Courier New""><span style=3D"font-size:1= 0.5pt">[i] !=3D </span></span></span></span><span style=3D"background-color= :rgb(0,0,0)"><span style=3D"color:rgb(206,145,120)"><span style=3D"font-fam= ily:"Courier New""><span style=3D"font-size:10.5pt">'</span><= /span></span></span><span style=3D"background-color:rgb(0,0,0)"><span style= =3D"color:rgb(215,186,125)"><span style=3D"font-family:"Courier New&qu= ot;"><span style=3D"font-size:10.5pt">\n</span></span></span></span><span s= tyle=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(206,145,120)"= ><span style=3D"font-family:"Courier New""><span style=3D"font-si= ze:10.5pt">'</span></span></span></span><span style=3D"background-color= :rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><span style=3D"font-fam= ily:"Courier New""><span style=3D"font-size:10.5pt"> ) {</span></= span></span></span><br></p><p dir=3D"ltr" style=3D"line-height:1.62857;marg= in-top:0pt;margin-bottom:0pt"><span style=3D"background-color:rgb(0,0,0)"><= span style=3D"color:rgb(212,212,212)"><span style=3D"font-family:"Cour= ier New""><span style=3D"font-size:10.5pt">319 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 </span></span></span></span><span style=3D"background-color:rgb(0,0,= 0)"><span style=3D"color:rgb(156,220,254)"><span style=3D"font-family:"= ;Courier New""><span style=3D"font-size:10.5pt">data</span></span></sp= an></span><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:= rgb(212,212,212)"><span style=3D"font-family:"Courier New""><span= style=3D"font-size:10.5pt">[i+</span></span></span></span><span style=3D"b= ackground-color:rgb(0,0,0)"><span style=3D"color:rgb(181,206,168)"><span st= yle=3D"font-family:"Courier New""><span style=3D"font-size:10.5pt= ">9</span></span></span></span><span style=3D"background-color:rgb(0,0,0)">= <span style=3D"color:rgb(212,212,212)"><span style=3D"font-family:"Cou= rier New""><span style=3D"font-size:10.5pt">] =3D </span></span></span= ></span><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:rg= b(156,220,254)"><span style=3D"font-family:"Courier New""><span s= tyle=3D"font-size:10.5pt">epdline</span></span></span></span><span style=3D= "background-color:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><span = style=3D"font-family:"Courier New""><span style=3D"font-size:10.5= pt">[i];</span></span></span></span><br></p><p dir=3D"ltr" style=3D"line-he= ight:1.62857;margin-top:0pt;margin-bottom:0pt"><span style=3D"background-co= lor:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><span style=3D"font-= family:"Courier New""><span style=3D"font-size:10.5pt">320 =C2=A0= =C2=A0 =C2=A0 =C2=A0 ++i;</span></span></span></span><br></p><p dir=3D"ltr= " style=3D"line-height:1.62857;margin-top:0pt;margin-bottom:0pt"><span styl= e=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><s= pan style=3D"font-family:"Courier New""><span style=3D"font-size:= 10.5pt">321 =C2=A0 =C2=A0 =C2=A0 =C2=A0 </span></span></span></span><span s= tyle=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(220,220,170)"= ><span style=3D"font-family:"Courier New""><span style=3D"font-si= ze:10.5pt">printf</span></span></span></span><span style=3D"background-colo= r:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><span style=3D"font-fa= mily:"Courier New""><span style=3D"font-size:10.5pt">(</span></sp= an></span></span><span style=3D"background-color:rgb(0,0,0)"><span style=3D= "color:rgb(206,145,120)"><span style=3D"font-family:"Courier New"= "><span style=3D"font-size:10.5pt">"%d %c 0x%X</span></span></span></s= pan><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(21= 5,186,125)"><span style=3D"font-family:"Courier New""><span style= =3D"font-size:10.5pt">\n</span></span></span></span><span style=3D"backgrou= nd-color:rgb(0,0,0)"><span style=3D"color:rgb(206,145,120)"><span style=3D"= font-family:"Courier New""><span style=3D"font-size:10.5pt">"= ;</span></span></span></span><span style=3D"background-color:rgb(0,0,0)"><s= pan style=3D"color:rgb(212,212,212)"><span style=3D"font-family:"Couri= er New""><span style=3D"font-size:10.5pt">, i, </span></span></span></= span><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(1= 56,220,254)"><span style=3D"font-family:"Courier New""><span styl= e=3D"font-size:10.5pt">data</span></span></span></span><span style=3D"backg= round-color:rgb(0,0,0)"><span style=3D"color:rgb(212,212,212)"><span style= =3D"font-family:"Courier New""><span style=3D"font-size:10.5pt">[= i+</span></span></span></span><span style=3D"background-color:rgb(0,0,0)"><= span style=3D"color:rgb(181,206,168)"><span style=3D"font-family:"Cour= ier New""><span style=3D"font-size:10.5pt">9</span></span></span></spa= n><span style=3D"background-color:rgb(0,0,0)"><span style=3D"color:rgb(212,= 212,212)"><span style=3D"font-family:"Courier New""><span style= =3D"font-size:10.5pt">], </span></span></span></span><span style=3D"backgro= und-color:rgb(0,0,0)"><span style=3D"color:rgb(156,220,254)"><span style=3D= "font-family:"Courier New""><span style=3D"font-size:10.5pt">epdl= ine</span></span></span></span><span style=3D"background-color:rgb(0,0,0)">= <span style=3D"color:rgb(212,212,212)"><span style=3D"font-family:"Cou= rier New""><span style=3D"font-size:10.5pt">[i]);</span></span></span>= </span><br></p><p dir=3D"ltr" style=3D"line-height:1.62857;margin-top:0pt;m= argin-bottom:0pt"><span style=3D"background-color:rgb(0,0,0)"><span style= =3D"color:rgb(212,212,212)"><span style=3D"font-family:"Courier New&qu= ot;"><span style=3D"font-size:10.5pt">322 =C2=A0 =C2=A0 =C2=A0 }</span></sp= an></span></span><br></p><div><br></div><p dir=3D"ltr" style=3D"line-height= :1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"background-color:tra= nsparent"><span style=3D"color:rgb(0,0,0)"><span style=3D"font-family:"= ;Times New Roman""><span style=3D"font-size:12pt">When parsing a valid= file with no endlines in it, if the filename is too long it overflows the = data buffer because the copying while loop is looking for newlines, not nul= ls to terminate the loop. For example, inputting:</span></span></span></spa= n><br></p><div><br></div><p dir=3D"ltr" style=3D"line-height:1.38;margin-to= p:0pt;margin-bottom:0pt"><span style=3D"background-color:transparent"><span= style=3D"color:rgb(0,0,0)"><span style=3D"font-family:"Times New Roma= n""><span style=3D"font-size:12pt">load /path/to/input/file/AAAAAAAAAA= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= AAAAAtest2</span></span></span></span><br></p><div><br></div><p dir=3D"ltr"= style=3D"line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D= "background-color:transparent"><span style=3D"color:rgb(0,0,0)"><span style= =3D"font-family:"Times New Roman""><span style=3D"font-size:12pt"= >File contents:</span></span></span></span><br></p><p dir=3D"ltr" style=3D"= line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style=3D"backgroun= d-color:transparent"><span style=3D"color:rgb(0,0,0)"><span style=3D"font-f= amily:"Times New Roman""><span style=3D"font-size:12pt">r5k1/p1p3= p1/3bqr2/3pN2p/3ppB2/P7/1P3P1Q/R3R1K1 b - - bm 1; id 1;\8Ar5kAAAAAAAAAAAAAA= AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=E2=80=A6 (~16Kb of A)</span></span><= /span></span><br></p><div><br></div><p dir=3D"ltr" style=3D"line-height:1.3= 8;margin-top:0pt;margin-bottom:0pt"><span style=3D"background-color:transpa= rent"><span style=3D"color:rgb(0,0,0)"><span style=3D"font-family:"Tim= es New Roman""><span style=3D"font-size:12pt">Results in a stack where= epdline has overflown into the buffer for handling user input, the base po= inter, and the return address on the stack.</span></span></span></span><br>= </p><div><br></div><div>Regards,<br></div><div><br></div><div>Henry Ballent= ine</div><div class=3D"gmail-m_-3480666382623028199protonmail_signature_blo= ck"><div class=3D"gmail-m_-3480666382623028199protonmail_signature_block-us= er gmail-m_-3480666382623028199protonmail_signature_block-empty"><br></div>= </div><div><br></div>_______________________________________________<br> Bug-gnu-chess mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">Bug-gnu-chess@gn= u.org</a><br> <a href=3D"https://lists.gnu.org/mailman/listinfo/bug-gnu-chess" rel=3D"nor= eferrer" target=3D"_blank">https://lists.gnu.org/mailman/listinfo/bug-gnu-c= hess</a><br> </blockquote></div> --0000000000002b761305909c5f83-- --===============7896786533259136423== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQnVnLWdudS1j aGVzcyBtYWlsaW5nIGxpc3QKQnVnLWdudS1jaGVzc0BnbnUub3JnCmh0dHBzOi8vbGlzdHMuZ251 Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL2J1Zy1nbnUtY2hlc3MK --===============7896786533259136423==--