【fuzz】hiredis --sanitizer undefined UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000013

环境信息】
x86
【测试版本】
Name: hiredis
Version: 1.0.2

【注意事项】
受影响版本排查（受影响/不受影响）
1、master
2、openEuler-20.03-LTS-SP3
3、openEuler-20.03-LTS-SP1
4、openEuler-20.03-LTS-SP2
5、openEuler-20.03-LTS
6、openEuler-21.03
7、openEuler-20.03-LTS-Next
8、openEuler-21.09
9、openEuler-22.03-LTS
10、openEuler-22.03-LTS-Next
11、openEuler-20.09
12、openEuler-22.03-LTS-SP1
一、【测试步骤】
1、编译
python3 infra/helper.py build_fuzzers --sanitizer undefined hiredis
2、执行
python3 infra/helper.py run_fuzzer hiredis format_command_fuzzer
【报错信息】
==12==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000013 (pc 0x7efe0a6445b0 bp 0x7ffdcc03f2b0 sp 0x7ffdcc03f278 T12)
==12==The signal is caused by a READ memory access.
==12==Hint: address points to the zero page.
#0 0x7efe0a6445b0 (/usr/lib64/libc.so.6+0x18f5b0)
#1 0x4b78ee in sdscatlen /src/hiredis/sds.c:383:5
#2 0x4b1372 in redisvFormatCommand /src/hiredis/hiredis.c
#3 0x4b2523 in redisFormatCommand /src/hiredis/hiredis.c:554:11
#4 0x4b0aae in LLVMFuzzerTestOneInput /src/hiredis/format_command_fuzzer.c:51:9
#5 0x43cf02 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
#6 0x43c6ea in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:514:3
#7 0x43ddc7 in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:757:19
#8 0x43ea75 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocatorfuzzer::SizedFile >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:895:5
#9 0x42e6b8 in fuzzer::FuzzerDriver(int*, char***, int ()(unsigned char const, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:912:6
#10 0x4567e2 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
#11 0x7efe0a4e220f (/usr/lib64/libc.so.6+0x2d20f)
#12 0x7efe0a4e22bb in __libc_start_main (/usr/lib64/libc.so.6+0x2d2bb)
#13 0x407af4 in _start (/out/format_command_fuzzer+0x407af4)

DEDUP_TOKEN: sdscatlen--redisvFormatCommand
UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (/usr/lib64/libc.so.6+0x18f5b0)
==12==ABORTING
MS: 4 ChangeBit-ChangeBinInt-ShuffleBytes-InsertRepeatedBytes-; base unit: d987edb3108ac3f2d18d174eaa53cd5b08b2acba
0x41,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xe5,0x25,0x62,0x28,0x20,0x78,0x62,
A\377\377\377\377\377\377\377\377\377\377\345%b( xb
artifact_prefix='./'; Test unit written to ./crash-79c977f1faaf50cb24aa3c395bc9e4fcc1175739
Base64: Qf/////////////lJWIoIHhi

【预期结果】
运行无异常

【实际结果】
运行出现异常

【复现步骤】
python3 infra/helper.py reproduce hiredis format_command_fuzzer crash-79c977f1faaf50cb24aa3c395bc9e4fcc1175739

Hi ryuo, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Base-service, and any of the maintainers: @Monday , @hexiaowen , @谢志鹏 , @zhujianwei001 , @caodongxia

原因分析：
出问题的地方：
sds.c:383 内容

378 sds sdscatlen(sds s, const void *t, size_t len) {
379  size_t curlen = sdslen(s);
380
381  s = sdsMakeRoomFor(s, len);
382  if (s == NULL) return NULL;
383  memcpy(s+curlen, t, len);
384  sdssetlen(s, curlen+len);
385  s[curlen+len] = '\0';
386  return s;
387}

向上一层的调用部分为hiredis.c：

305 int redisvFormatCommand (......

361        case 'b':
362            arg = va_arg(ap,char*);
363            size = va_arg(ap,size_t);
364            if (size > 0)
365                newarg = sdscatlen(curarg, arg, size);

问题表面原因是hiredis.c:362行，在获取参数时返回的char* 指针内容为0x000000000013，作为入参将arg传入sdscatlen，再被memcpy访问，访问的0x000000000013因权限问题，产生段错误。
根因：hiredis.c:362 va_arg(ap,char*)返回非法指针的原因，是可变参数函数redisFormatCommand,并没有提供可被var_arg获取的参数，在参数数量缺少的情况下，var_arg返回了非法指针。
验证的方法：编辑文件project/hiredis/hiredis-1.0.2/fuzzing/format_command_fuzzer.c文件，添加缺失的参数：
if (redisFormatCommand(&cmd, new_str, "11", 2) != -1)
hi_free(cmd)
新编译后再用crash文件复现，问题已经解决。

结论：这个issue因为是fuzz用例的不完善导致的问题，建议非问题关闭

src-openEuler / hiredis

内容风险标识

评论 (2)

src-openEuler / hiredis .gitee-modal { width: 500px !important; }

内容风险标识