Re: [BUG] heap-buffer-overflow(read) pmatch() src/expand.c:1630:18

It's fixed here: 4595bd6549344c90ce7e8e90f1034cec724884db

пт, 16 янв. 2026 г. в 22:16, Aleksander Ushakov <[email protected]>:
>
> Dear Dash maintainers,
>
> I encountered a bug in Dash in commit f8aaaa and would like to report
> it. The details are provided below.
>
> =================================================================
> ==4318==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5030000003e3 at pc 0x652f51dd63bf bp 0x7ffd65724250 sp 0x7ffd65724248
> READ of size 1 at 0x5030000003e3 thread T0
>     #0 0x652f51dd63be in pmatch /upstream/dash/src/expand.c:1630:18
>     #1 0x652f51dd74d8 in expmeta /upstream/dash/src/expand.c:1391:7
>     #2 0x652f51dd1cc1 in expandmeta /upstream/dash/src/expand.c:1271:3
>     #3 0x652f51dd0c2c in expandarg /upstream/dash/src/expand.c:206:3
>     #4 0x652f51dc866b in evalcommand /upstream/dash/src/eval.c:806:4
>     #5 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
>     #6 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
>     #7 0x652f51de1dd2 in cmdloop /upstream/dash/src/main.c:242:8
>     #8 0x652f51de19de in main /upstream/dash/src/main.c:176:3
>     #9 0x74bc543e8249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
>     #10 0x74bc543e8304 in __libc_start_main csu/../csu/libc-start.c:360:3
>     #11 0x652f51ce3530 in _start (/upstream/dash/src/dash+0x38530) (BuildId: 7f6a58087379909d6c654473930c3998f14e8e99)
>
> 0x5030000003e3 is located 0 bytes after 19-byte region [0x5030000003d0,0x5030000003e3)
> allocated by thread T0 here:
>     #0 0x652f51d827cf in malloc (/upstream/dash/src/dash+0xd77cf) (BuildId: 7f6a58087379909d6c654473930c3998f14e8e99)
>     #1 0x652f51de24d4 in ckmalloc /upstream/dash/src/memalloc.c:55:6
>     #2 0x652f51dd2a8a in _rmescapes /upstream/dash/src/expand.c:1687:8
>     #3 0x652f51dd55e3 in preglob /upstream/dash/src/expand.c:151:9
>     #4 0x652f51dd1c81 in expandmeta /upstream/dash/src/expand.c:1266:7
>     #5 0x652f51dd0c2c in expandarg /upstream/dash/src/expand.c:206:3
>     #6 0x652f51dc866b in evalcommand /upstream/dash/src/eval.c:806:4
>     #7 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
>     #8 0x652f51dc7855 in evaltree /upstream/dash/src/eval.c:299:12
>     #9 0x652f51de1dd2 in cmdloop /upstream/dash/src/main.c:242:8
>     #10 0x652f51de19de in main /upstream/dash/src/main.c:176:3
>     #11 0x74bc543e8249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
>
> SUMMARY: AddressSanitizer: heap-buffer-overflow /upstream/dash/src/expand.c:1630:18 in pmatch
> Shadow bytes around the buggy address:
>   0x503000000100: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
>   0x503000000180: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
>   0x503000000200: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
>   0x503000000280: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
>   0x503000000300: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
> =>0x503000000380: 00 00 fa fa 00 00 03 fa fa fa 00 00[03]fa fa fa
>   0x503000000400: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x503000000480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x503000000500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x503000000580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
>   0x503000000600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
> Shadow byte legend (one shadow byte represents 8 application bytes):
>   Addressable:           00
>   Partially addressable: 01 02 03 04 05 06 07
>   Heap left redzone:       fa
>   Freed heap region:       fd
>   Stack left redzone:      f1
>   Stack mid redzone:       f2
>   Stack right redzone:     f3
>   Stack after return:      f5
>   Stack use after scope:   f8
>   Global redzone:          f9
>   Global init order:       f6
>   Poisoned by user:        f7
>   Container overflow:      fc
>   Array cookie:            ac
>   Intra object redzone:    bb
>   ASan internal:           fe
>   Left alloca redzone:     ca
>   Right alloca redzone:    cb
> ==4318==ABORTING
>
> ////////////////
> Place in code
> ////////////////
>                                         if (chr == c)
>                                                 found = 1;
>                                 }
>                  ---->} while ((c = *p++) != ']');
>                         if (found == invert)
>                                 return 0;
>                         q++;
>
>
> ////////////////
> My environment:
> ////////////////
>
> Debian-12, x86-64, clang-19 compiler
>
> /////////////////
> Steps to reproduce:
> /////////////////
>
> $ aclocal && autoheader && automake --add-missing && autoconf
> $ CC=clang CFLAGS=" -Wno-everything -fsanitize=address -g -O0" ./configure --disable-fnmatch --disable-lineno --disable-glob
> $ make
> $ cd src
> $ ./dash < myfile.txt
>
> //////////////////
> Steps to get myfile.txt:
> //////////////////
>
> copy the text into file bs64.txt (between ==== and ======):
> =====================================================================================
> PkA3OyRCLWdlIFuFaZs/PwJlc3Nzc3Nzc3Mt
> =====================================================================================
> Or just take from attachments:
>