[Bug 9241] New: Stack exhaustion in evaltree

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=9241

            Bug ID: 9241
           Summary: Stack exhaustion in evaltree
           Product: Busybox
           Version: unspecified
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Other
          Assignee: unassigned at busybox.net
          Reporter: franco.costantini20 at gmail.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

Hello, we recently found a stack exhaustion parsing and executing fuzzed bash
code in Busybox 1.25.0.
We tested this issue on Ubuntu 14.04.5 (x86_64) but other configurations could
be affected. Please find attached the full .config file

gdb backtrace is as follows:

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00000000004c48fc in evaltree (n=0x603400615988, flags=0) at shell/ash.c:8341
8341    {
#0  0x00000000004c48fc in evaltree (n=0x603400615988, flags=0) at
shell/ash.c:8341
#1  0x00000000004c4c52 in evaltree (n=0x603400615a10, flags=0) at
shell/ash.c:8429
#2  0x00000000004c4c52 in evaltree (n=0x603400615628, flags=0) at
shell/ash.c:8429
#3  0x00000000004c4c52 in evaltree (n=0x6034006156b0, flags=0) at
shell/ash.c:8429
#4  0x00000000004c4c52 in evaltree (n=0x603400615738, flags=0) at
shell/ash.c:8429
#5  0x00000000004c4c52 in evaltree (n=0x6034006157c0, flags=0) at
shell/ash.c:8429
#6  0x00000000004c4c52 in evaltree (n=0x6034006153d0, flags=0) at
shell/ash.c:8429
#7  0x00000000004c4c52 in evaltree (n=0x603400615458, flags=0) at
shell/ash.c:8429
#8  0x00000000004c4c52 in evaltree (n=0x6034006154e0, flags=0) at
shell/ash.c:8429
#9  0x00000000004c4c52 in evaltree (n=0x603400615568, flags=0) at
shell/ash.c:8429
#10 0x00000000004c4c52 in evaltree (n=0x603400615178, flags=0) at
shell/ash.c:8429
#11 0x00000000004c4c52 in evaltree (n=0x603400615200, flags=0) at
shell/ash.c:8429
#12 0x00000000004c4c52 in evaltree (n=0x603400615288, flags=0) at
shell/ash.c:8429
#13 0x00000000004c4c52 in evaltree (n=0x603400614ea8, flags=0) at
shell/ash.c:8429
#14 0x00000000004c4c52 in evaltree (n=0x603400614f30, flags=0) at
shell/ash.c:8429
#15 0x00000000004c4c52 in evaltree (n=0x603400614fb8, flags=0) at
shell/ash.c:8429
#16 0x00000000004c4c52 in evaltree (n=0x603400615040, flags=0) at
shell/ash.c:8429
#17 0x00000000004c4c52 in evaltree (n=0x603400614c50, flags=0) at
shell/ash.c:8429
#18 0x00000000004c4c52 in evaltree (n=0x603400614cd8, flags=0) at
shell/ash.c:8429
#19 0x00000000004c4c52 in evaltree (n=0x603400614d60, flags=0) at
shell/ash.c:8429
#20 0x00000000004c4c52 in evaltree (n=0x603400614de8, flags=0) at
shell/ash.c:8429
#21 0x00000000004c4c52 in evaltree (n=0x6034006149f8, flags=0) at
shell/ash.c:8429
#22 0x00000000004c4c52 in evaltree (n=0x603400614a80, flags=0) at
shell/ash.c:8429
#23 0x00000000004c4c52 in evaltree (n=0x603400614b10, flags=0) at
shell/ash.c:8429
#24 0x00000000004c4c52 in evaltree (n=0x603400614728, flags=0) at
shell/ash.c:8429

This issue was found using QuickFuzz, the file to reproduce it is attached.
Regards.

-- 
You are receiving this mail because:
You are on the CC list for the bug.