[Bug 3190] New: Segmentation fault in parse_quote_2047.c

https://bugs.exim.org/show_bug.cgi?id=3190

            Bug ID: 3190
           Summary: Segmentation fault in parse_quote_2047.c
           Product: Exim
           Version: 4.99
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: bug
          Priority: medium
         Component: General execution
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected]

Created attachment 1529
  --> https://bugs.exim.org/attachment.cgi?id=1529&action=edit
File with crash input

I have found SEGV in parse_quote_2047.c:894:

if (g->ptr - line_off > 67 && !first_byte)

While parsing the input in the loop *g pointer gets the value 0x04. After
dereference *g pointer segmentation fault happens.

ASAN report:
==1429675==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc
0x57ed37166916 bp 0x00000000002e sp 0x7ffe1af9bca0 T0)
==1429675==The signal is caused by a READ memory access.
==1429675==Hint: address points to the zero page.
    #0 0x57ed37166916 in parse_quote_2047
(/exim-main/src/build-Linux-x86_64/parser_harness+0x1c2916) (BuildId:
6ef612da76205d7bc795ea8d2e53ba9d09bdb019)
    #1 0x57ed37166ad6 in parse_fix_phrase
(/exim-main/src/build-Linux-x86_64/parser_harness+0x1c2ad6) (BuildId:
6ef612da76205d7bc795ea8d2e53ba9d09bdb019)
    #2 0x57ed370d9f50 in main
/exim-main/src/build-Linux-x86_64/../parser_harness.c:43:9
    #3 0x78885216a249 in __libc_start_call_main
csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #4 0x78885216a304 in __libc_start_main csu/../csu/libc-start.c:360:3
    #5 0x57ed36ffa3c0 in _start
(/exim-main/src/build-Linux-x86_64/parser_harness+0x563c0) (BuildId:
6ef612da76205d7bc795ea8d2e53ba9d09bdb019)

==1429675==Register values:
rax = 0x000052d000003c8a  rbx = 0x0000000000000000  rcx = 0x0000000000000058 
rdx = 0x0000000000008000  
rdi = 0x000053100000880d  rsi = 0x000000000000000c  rbp = 0x000000000000002e 
rsp = 0x00007ffe1af9bca0  
 r8 = 0x00000afda6e32639   r9 = 0x0000000000000000  r10 = 0x0000000000000000 
r11 = 0x0000000000000000  
r12 = 0x0000000000000001  r13 = 0x000052d00000241a  r14 = 0x000000000000002e 
r15 = 0x0000000000007fb8  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
(/exim-main/src/build-Linux-x86_64/parser_harness+0x1c2916) (BuildId:
6ef612da76205d7bc795ea8d2e53ba9d09bdb019) in parse_quote_2047

Possible fix is to check *g pointer before dereference:

diff --git a/src/src/parse.c b/src/src/parse.c
index 1fe4f70f8..bef9424c9 100644
--- a/src/src/parse.c
+++ b/src/src/parse.c
@@ -891,7 +891,7 @@ for (const uschar * s = string; len > 0; s++, len--)
   {
   int ch = *s;

-  if (g->ptr - line_off > 67 && !first_byte)
+  if (g && g->ptr - line_off > 67 && !first_byte)
     {
     g = fold ? string_catn(g, US"?=\n ", 4) : string_catn(g, US"?= ", 3);
     line_off = g->ptr;

File with crash input in attachment.

-- 
You are receiving this mail because:
You are on the CC list for the bug.