{"action":"closed","issue":{"url":"https://api.github.com/repos/avast-tl/retdec/issues/250","repository_url":"https://api.github.com/repos/avast-tl/retdec","labels_url":"https://api.github.com/repos/avast-tl/retdec/issues/250/labels{/name}","comments_url":"https://api.github.com/repos/avast-tl/retdec/issues/250/comments","events_url":"https://api.github.com/repos/avast-tl/retdec/issues/250/events","html_url":"https://github.com/avast-tl/retdec/issues/250","id":306166617,"number":250,"title":"fileinfo crashes when computing SHA-1 hash of PE digital signature","user":{"login":"s3rvac","id":5675953,"avatar_url":"https://avatars3.githubusercontent.com/u/5675953?v=4","gravatar_id":"","url":"https://api.github.com/users/s3rvac","html_url":"https://github.com/s3rvac","followers_url":"https://api.github.com/users/s3rvac/followers","following_url":"https://api.github.com/users/s3rvac/following{/other_user}","gists_url":"https://api.github.com/users/s3rvac/gists{/gist_id}","starred_url":"https://api.github.com/users/s3rvac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/s3rvac/subscriptions","organizations_url":"https://api.github.com/users/s3rvac/orgs","repos_url":"https://api.github.com/users/s3rvac/repos","events_url":"https://api.github.com/users/s3rvac/events{/privacy}","received_events_url":"https://api.github.com/users/s3rvac/received_events","type":"User","site_admin":false},"labels":[{"id":782731717,"url":"https://api.github.com/repos/avast-tl/retdec/labels/C-fileformat","name":"C-fileformat","color":"FFC274","default":false},{"id":782733776,"url":"https://api.github.com/repos/avast-tl/retdec/labels/P-run","name":"P-run","color":"fbca04","default":false},{"id":829888976,"url":"https://api.github.com/repos/avast-tl/retdec/labels/T-format-pe","name":"T-format-pe","color":"000000","default":false},{"id":776470493,"url":"https://api.github.com/repos/avast-tl/retdec/labels/bug","name":"bug","color":"ee0701","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-03-17T15:47:55Z","updated_at":"2018-03-21T15:08:09Z","closed_at":"2018-03-21T15:08:08Z","author_association":"OWNER","body":"`fileinfo` crashes when computing the SHA-1 hash of a digital signature of the attached PE file.\r\n\r\n## Input\r\n\r\nRun\r\n```\r\nretdec-fileinfo FILE\r\n```\r\nwhere `FILE` is:\r\n\r\n* [34722C26B5557979DE5B4DCAE01DD4D0CD1DC99AF78656D7DA93D3B6BB907C9A](https://www.virustotal.com/intelligence/search/?query=34722C26B5557979DE5B4DCAE01DD4D0CD1DC99AF78656D7DA93D3B6BB907C9A)\r\n\r\n## Output\r\n\r\n```\r\nSegmentation fault\r\n```\r\n\r\n## Expected output\r\n\r\n`fileinfo` does not crash during the analysis.\r\n\r\n## Output from valgrind\r\n\r\n```\r\nInvalid read of size 8\r\n   at 0x5A7F8AB: SHA1_Update (in /usr/lib/libcrypto.so.1.1)\r\n   by 0x64831B: retdec::crypto::HashContext::addData(unsigned char const*, unsigned long) (hash_context.cpp:71)\r\n   by 0x29DB39: retdec::fileformat::PeFormat::calculateDigest[abi:cxx11](retdec::crypto::HashAlgorithm) const (pe_format.cpp:1340)\r\n   by 0x29D1C6: retdec::fileformat::PeFormat::verifySignature(pkcs7_st*) (pe_format.cpp:1260)\r\n   by 0x29BCD5: retdec::fileformat::PeFormat::loadCertificates() (pe_format.cpp:978)\r\n   by 0x298337: retdec::fileformat::PeFormat::initStructures() (pe_format.cpp:385)\r\n   by 0x297B81: retdec::fileformat::PeFormat::PeFormat(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, retdec::fileformat::LoadFlags) (pe_format.cpp:296)\r\n   by 0x20C444: fileinfo::PeWrapper::PeWrapper(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, retdec::fileformat::LoadFlags) (pe_wrapper.cpp:96)\r\n   by 0x194903: void __gnu_cxx::new_allocator<...>::construct<...>(...) (new_allocator.h:136)\r\n   by 0x1947BD: void std::allocator_traits<...>::construct<...>(...) (alloc_traits.h:475)\r\n   by 0x194600: std::_Sp_counted_ptr_inplace<...>::_Sp_counted_ptr_inplace<...>(...) (shared_ptr_base.h:526)\r\n   by 0x194356: std::__shared_count<...>::__shared_count<...>(...) (shared_ptr_base.h:637)\r\n Address 0x107160988 is not stack'd, malloc'd or (recently) free'd\r\n```\r\n\r\n## Notes\r\n\r\nThis issue may be related to #87, but there are several differences:\r\n* In #87, the crash happens right at the beginning of `verifySignature()`, but in this case, it crashes when verifying the digest by computing the SHA-1 hash.\r\n* In #87, we are unable to find a signer or counter-signer, but in this case, we are able to find both signer and counter-signer. Moreover, if I disable signature verification by commenting it out, `retdec-fileinfo --verbose` is able to parse the certificate table in this case:\r\n```\r\nCertificate table\r\n-----------------\r\nNumber of certificates          : 3\r\nSigner certificate index        : 0\r\nCounter-signer certificate index: 1\r\n\r\nCertificate #0\r\nSubject name        : Systweak Inc\r\n...\r\n\r\nCertificate #1\r\nSubject name        : VeriSign Time Stamping Services Signer - G2\r\n..\r\n\r\nCertificate #2\r\nSubject name        : VeriSign Time Stamping Services CA\r\n...\r\n```\r\n* The fix proposed in #249 fixes #87 but is insufficient to fix the present issue.\r\n\r\n## Configuration\r\n\r\n* Commit: 8cc759b70f2ccda3eac2b4d710043fe04b16fc44 (current `master`)\r\n* 64b Arch Linux, GCC 7.3.0, Debug build of RetDec\r\n* OpenSSL 1.1.0.g (system version)\r\n"}}
{"actor":{"display_login":"metthal"}}