Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

test failure because of a global-buffer-overflow #820

Open
asarubbo opened this issue Sep 13, 2023 · 0 comments
Open

test failure because of a global-buffer-overflow #820

asarubbo opened this issue Sep 13, 2023 · 0 comments

Comments

@asarubbo
Copy link

Our Gentoo Tinderbox reported a test failure at bug 914093

Looking at the LastTest.log I can see there are two different buffer overflow.

==102==ERROR: AddressSanitizer: global-buffer-overflow on address 0x560e33c69072 at pc 0x7f84a8b4455e bp 0x7ffcd45b5c60 sp 0x7ffcd45b5c50
READ of size 1 at 0x560e33c69072 thread T0
    #0 0x7f84a8b4455d in GSM_UnpackEightBitsToSeven /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/misc/coding/coding.c:1003
    #1 0x7f84a8b4bc68 in GSM_DecodeSMSFrameText /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/service/sms/gsmsms.c:354
    #2 0x7f84a8b5055d in GSM_DecodeSMSFrame /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/service/sms/gsmsms.c:855
    #3 0x560e33b1a715 in main /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/tests/sms-nokia-01.c:47
    #4 0x7f84a8823c89  (/lib64/libc.so.6+0x23c89)
    #5 0x7f84a8823d44 in __libc_start_main (/lib64/libc.so.6+0x23d44)
    #6 0x560e33b1a8c0 in _start (/var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0_build/tests/sms-nokia-01+0x248c0)

0x560e33c69072 is located 0 bytes after global variable 'data' defined in '/var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/tests/sms-nokia-01.c:13:15' (0x560e33c69040) of size 50
SUMMARY: AddressSanitizer: global-buffer-overflow /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/misc/coding/coding.c:1003 in GSM_UnpackEightBitsToSeven
==809==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7ff162562e22 at pc 0x7ff162257d61 bp 0x7ffd51bd2480 sp 0x7ffd51bd2470
READ of size 2 at 0x7ff162562e22 thread T0
    #0 0x7ff162257d60 in mywstrstr /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/misc/coding/coding.c:1594
    #1 0x7ff16255a892 in SMSDFiles_FindOutboxSMS /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/services/files.c:386
    #2 0x7ff162555996 in SMSD_SendSMS /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/core.c:1684
    #3 0x7ff162557df7 in SMSD_MainLoop /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/core.c:2338
    #4 0x55949cc1e7e2 in main /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/main.c:517
    #5 0x7ff161e23c89  (/lib64/libc.so.6+0x23c89)
    #6 0x7ff161e23d44 in __libc_start_main (/lib64/libc.so.6+0x23d44)
    #7 0x55949cc1ea60 in _start (/var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0_build/smsd/gammu-smsd+0x21a60)

0x7ff162562e23 is located 0 bytes after global variable '*.LC35' defined in '/var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/services/files.c' (0x7ff162562e20) of size 3
0x7ff162562e22 is located 62 bytes before global variable '*.LC36' defined in '/var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/smsd/services/files.c' (0x7ff162562e60) of size 85
  '*.LC36' is ascii string 'Found %i sms to "%s" with bookmark "%s" cod %i lgt %i udh: t %i l %i dlr: %i fls: %i'
SUMMARY: AddressSanitizer: global-buffer-overflow /var/tmp/portage/app-mobilephone/gammu-1.42.0-r1/work/gammu-1.42.0/libgammu/misc/coding/coding.c:1594 in mywstrstr

I didn't look deeply into these issues but they appear to be related to libgammu, and then there are possible security implications/impacts.
If I can do more, please let me know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant