Headline
CVE-2022-35016: Poc/CVE-2022-35016.md at main · Cvjark/Poc
Advancecomp v2.3 was discovered to contain a heap buffer overflow.
Permalink
Cannot retrieve contributors at this time
Product link
https://github.com/amadvance/advancecomp
POC file
https://github.com/Cvjark/Poc/files/9060011/id1_command_advzip_-x_heap-buffer-overflow_sample_No.zip
Command to reproduce
./advzip -x [sample file]
Product name & version
last github commit code : a543d4c
Problem Type
Heap buffer overflow
Crash Detail
==96177==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000015c at pc 0x0000004b07b2 bp 0x7ffff13f3a60 sp 0x7ffff13f3210
READ of size 256 at 0x61200000015c thread T0
#0 0x4b07b1 in __asan_memcpy /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22
#1 0x52acdb in data_dup(unsigned char const*, unsigned int) /home/bupt/Desktop/advancecomp/data.cc:39:4
#2 0x51e5d9 in zip::open() /home/bupt/Desktop/advancecomp/zip.cc:888:21
#3 0x504089 in extract_all(int, char**, bool) /home/bupt/Desktop/advancecomp/rezip.cc:301:4
#4 0x508c3d in process(int, char**) /home/bupt/Desktop/advancecomp/rezip.cc:604:3
#5 0x509b88 in main /home/bupt/Desktop/advancecomp/rezip.cc:623:3
#6 0x7f7831f27c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
#7 0x41f1e9 in _start (/home/bupt/Desktop/advancecomp/advzip+0x41f1e9)
0x61200000015c is located 0 bytes to the right of 284-byte region [0x612000000040,0x61200000015c)
allocated by thread T0 here:
#0 0x4b17b0 in malloc /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145
#1 0x52ada4 in data_alloc(unsigned int) /home/bupt/Desktop/advancecomp/data.cc:51:40
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22 in __asan_memcpy
Shadow bytes around the buggy address:
0x0c247fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8020: 00 00 00 00 00 00 00 00 00 00 00[04]fa fa fa fa
0x0c247fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==96177==ABORTING
Crash summary
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/bupt/Desktop/tools/llvm-12.0.1/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22 in __asan_memcpyRelated news
Ubuntu Security Notice 5838-1 - It was discovered that AdvanceCOMP did not properly manage memory while performing read operations on MNG file. If a user were tricked into opening a specially crafted MNG file, a remote attacker could possibly use this issue to cause AdvanceCOMP to crash, resulting in a denial of service. It was discovered that AdvanceCOMP did not properly manage memory while performing read operations on ZIP file. If a user were tricked into opening a specially crafted ZIP file, a remote attacker could possibly use this issue to cause AdvanceCOMP to crash, resulting in a denial of service.