{"action":"opened","issue":{"url":"https://api.github.com/repos/libical/libical/issues/251","repository_url":"https://api.github.com/repos/libical/libical","labels_url":"https://api.github.com/repos/libical/libical/issues/251/labels{/name}","comments_url":"https://api.github.com/repos/libical/libical/issues/251/comments","events_url":"https://api.github.com/repos/libical/libical/issues/251/events","html_url":"https://github.com/libical/libical/issues/251","id":193130052,"number":251,"title":"A heap-buffer-overflow in icaltime_from_string","user":{"login":"agustinmista","id":5265348,"avatar_url":"https://avatars.githubusercontent.com/u/5265348?v=3","gravatar_id":"","url":"https://api.github.com/users/agustinmista","html_url":"https://github.com/agustinmista","followers_url":"https://api.github.com/users/agustinmista/followers","following_url":"https://api.github.com/users/agustinmista/following{/other_user}","gists_url":"https://api.github.com/users/agustinmista/gists{/gist_id}","starred_url":"https://api.github.com/users/agustinmista/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agustinmista/subscriptions","organizations_url":"https://api.github.com/users/agustinmista/orgs","repos_url":"https://api.github.com/users/agustinmista/repos","events_url":"https://api.github.com/users/agustinmista/events{/privacy}","received_events_url":"https://api.github.com/users/agustinmista/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-02T14:33:52Z","updated_at":"2016-12-02T14:33:52Z","closed_at":null,"body":"Hello, we recently found a memmory issue parsing and executing fuzzed ical file in last revision of libical (#19acf43794ad4c99f7e6687cb39424a82b737828).\r\nWe tested this issue on Ubuntu 14.04 but other configurations could be affected.\r\nTechnical details about the issue are:\r\n\r\n```\r\n==8557==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60300000caa3 at pc 0x7ffff7b187ce bp 0x7fffffff87f0 sp 0x7fffffff87e8\r\nREAD of size 1 at 0x60300000caa3 thread T0\r\n```\r\n\r\ngdb backtrace is as follows:\r\n\r\n```\r\n#0  0x00007ffff61cfc37 in __GI_raise (sig=sig@entry=6)\r\n    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56\r\n#1  0x00007ffff61d3028 in __GI_abort () at abort.c:89\r\n#2  0x00000000004b12b6 in __sanitizer::Abort() ()\r\n#3  0x00000000004a1f97 in __asan::AsanDie() ()\r\n#4  0x00000000004a89cf in __sanitizer::Die() ()\r\n#5  0x00000000004a062b in __asan::ScopedInErrorReport::~ScopedInErrorReport() ()\r\n#6  0x00000000004a0171 in __asan_report_error ()\r\n#7  0x00000000004a0db7 in __asan_report_load1 ()\r\n#8  0x00007ffff7b187ce in icaltime_from_string (str=<optimized out>)\r\n    at /home/agustin/Code/libical/src/libical/icaltime.c:448\r\n#9  0x00007ffff7b5756f in icalvalue_new_from_string_with_error (kind=<optimized out>, \r\n    str=<optimized out>, error=<optimized out>)\r\n    at /home/agustin/Code/libical/src/libical/icalvalue.c:637\r\n#10 0x00007ffff7b548db in icalvalue_new_from_string (kind=ICAL_DATETIME_VALUE, \r\n    str=0x60300000ca90 \"18640529T011608z\")\r\n    at /home/agustin/Code/libical/src/libical/icalvalue.c:756\r\n#11 0x00007ffff7ad080a in icalparser_add_line (parser=<optimized out>, \r\n    line=<optimized out>) at /home/agustin/Code/libical/src/libical/icalparser.c:1147\r\n#12 0x00000000004b8c3f in main (argc=2, argv=0x7fffffffdf08)\r\n    at /home/agustin/Code/libical/src/test/icaltestparser.c:104\r\n```\r\n\r\nThis issue was found using QuickFuzz, the file to reproduce it is [attached](https://github.com/libical/libical/files/627371/heap-buffer-overflow.ical.txt).\r\nRegards."}}
{"actor":{"display_login":"agustinmista"}}