{"action":"opened","issue":{"url":"https://api.github.com/repos/tats/w3m/issues/26","repository_url":"https://api.github.com/repos/tats/w3m","labels_url":"https://api.github.com/repos/tats/w3m/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/tats/w3m/issues/26/comments","events_url":"https://api.github.com/repos/tats/w3m/issues/26/events","html_url":"https://github.com/tats/w3m/issues/26","id":173652813,"number":26,"title":"heap buffer overflow write in addMultirowsForm()","user":{"login":"kcwu","id":175566,"avatar_url":"https://avatars.githubusercontent.com/u/175566?v=3","gravatar_id":"","url":"https://api.github.com/users/kcwu","html_url":"https://github.com/kcwu","followers_url":"https://api.github.com/users/kcwu/followers","following_url":"https://api.github.com/users/kcwu/following{/other_user}","gists_url":"https://api.github.com/users/kcwu/gists{/gist_id}","starred_url":"https://api.github.com/users/kcwu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kcwu/subscriptions","organizations_url":"https://api.github.com/users/kcwu/orgs","repos_url":"https://api.github.com/users/kcwu/repos","events_url":"https://api.github.com/users/kcwu/events{/privacy}","received_events_url":"https://api.github.com/users/kcwu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-28T15:44:14Z","updated_at":"2016-08-28T15:44:14Z","closed_at":null,"body":"input\r\n```\r\n00000000: 3c74 6162 6c65 3e30 3c62 7574 746f 6e20  <table>0<button\r\n00000010: 7661 6c75 653d 2722 3e30 3030 3030 3030  value='\">0000000\r\n00000020: 3030 3027 3e30 3030 3030 3030 3030 3030  000'>00000000000\r\n00000030: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000\r\n00000040: 3030 3030 3030 3030 3030 3030 3030 3030  0000000000000000\r\n00000050: 3030 3030 3030 3030 3030 3030 3030 3c74  00000000000000<t\r\n00000060: 6578 7461 7265 6120 726f 7773 3d32 3030  extarea rows=200\r\n00000070: 3030 3e                                  00>\r\n```\r\n\r\n```\r\nProgram received signal SIGSEGV, Segmentation fault.\r\n0x0000000000438b33 in calcPosition (l=0x9c1500 \" ]          [         \", pr=0x5b009c7f60, len=22, pos=1, bpos=0, mode=0) at etc.c:515\r\n515         if (pr[i] & PC_WCHAR2) {\r\n(gdb) p pr\r\n$1 = (Lineprop *) 0x5b009c7f60\r\n(gdb) p i\r\n$2 = 0\r\n(gdb) p pr[i]\r\nCannot access memory at address 0x5b009c7f60\r\n```\r\n`pr` is corrupted. Note the correct address of `pr` is 0x9c7f60 but its highest byte is overwritten by 0x5b=='[' \r\n\r\nThis is because buffer overflows earlier in addMultirowsForm (several times). With following assertion, it can catch the overflow easier.\r\n```\r\ndiff --git a/anchor.c b/anchor.c\r\nindex 2d21bfa..3eb30d2 100644\r\n--- a/anchor.c\r\n+++ b/anchor.c\r\n@@ -1,4 +1,5 @@\r\n /* $Id: anchor.c,v 1.33 2006/04/08 11:33:16 inu Exp $ */\r\n+#include <assert.h>\r\n #include \"fm.h\"\r\n #include \"myctype.h\"\r\n #include \"regex.h\"\r\n@@ -686,6 +687,7 @@ addMultirowsForm(Buffer *buf, AnchorList *al)\r\n            a->y = a_form.y;\r\n            a->end.pos = pos + ecol - col;\r\n            l->lineBuf[pos - 1] = '[';\r\n+           assert(a->end.pos < l->size);\r\n            l->lineBuf[a->end.pos] = ']';\r\n            for (k = pos; k < a->end.pos; k++)\r\n                l->propBuf[k] |= PE_FORM;\r\n```\r\n\r\n```\r\nw3m: anchor.c:690: addMultirowsForm: Assertion `a->end.pos < l->size' failed.\r\n\r\nProgram received signal SIGABRT, Aborted.\r\n0x00007ffff6c75c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.\r\n(gdb) bt\r\n#0  0x00007ffff6c75c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n#1  0x00007ffff6c79028 in __GI_abort () at abort.c:89\r\n#2  0x00007ffff6c6ebf6 in __assert_fail_base (fmt=0x7ffff6dbf3b8 \"%s%s%s:%u: %s%sAssertion `%s' failed.\\n%n\", assertion=assertion@entry=0x49cfc2 \"a->end.pos < l->size\",\r\n    file=file@entry=0x49cfb9 \"anchor.c\", line=line@entry=690, function=function@entry=0x49d0f0 <__PRETTY_FUNCTION__.19282> \"addMultirowsForm\") at assert.c:92\r\n#3  0x00007ffff6c6eca2 in __GI___assert_fail (assertion=0x49cfc2 \"a->end.pos < l->size\", file=0x49cfb9 \"anchor.c\", line=690,\r\n    function=0x49d0f0 <__PRETTY_FUNCTION__.19282> \"addMultirowsForm\") at assert.c:101\r\n#4  0x0000000000475a5c in addMultirowsForm (buf=0x7d3e00, al=0x7ea7c0) at anchor.c:690\r\n#5  0x000000000042acde in HTMLlineproc2body (buf=0x7d3e00, feed=0x4282b8 <textlist_feed>, llimit=-1) at file.c:6142\r\n#6  0x000000000042aeeb in HTMLlineproc2 (buf=0x7d3e00, tl=0x7cc2e0) at file.c:6195\r\n#7  0x000000000042e0d5 in loadHTMLstream (f=0x7fffffffd130, newBuf=0x7d3e00, src=0x0, internal=0) at file.c:7281\r\n#8  0x000000000042c8fe in loadHTMLBuffer (f=0x7fffffffd130, newBuf=0x7d3e00) at file.c:6778\r\n#9  0x0000000000416ae0 in loadSomething (f=0x7fffffffd130, loadproc=0x42c7fc <loadHTMLBuffer>, defaultbuf=0x7d3e00) at file.c:224\r\n#10 0x000000000041c8fe in loadGeneralFile (path=0x7bdf00 \"triage.debug/min/3\", current=0x0, referer=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>,\r\n    flag=0, request=0x0) at file.c:2245\r\n#11 0x0000000000407171 in main (argc=5, argv=0x7fffffffd458, envp=0x7fffffffd488) at main.c:1020\r\n(gdb) frame 4\r\n#4  0x0000000000475a5c in addMultirowsForm (buf=0x7d3e00, al=0x7ea7c0) at anchor.c:690\r\n690                 assert(a->end.pos < l->size);\r\n(gdb) p a->end.pos\r\n$1 = 33\r\n(gdb) p l->size\r\n$2 = 22\r\n```"}}
{"actor":{"display_login":"kcwu"}}