[Bug 16147] New: Out-of-bounds Read at ash

[bugzilla at busybox.net]

https://bugs.busybox.net/show_bug.cgi?id=16147

            Bug ID: 16147
           Summary: Out-of-bounds Read at ash
           Product: Busybox
           Version: 1.36.x
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: Standard Compliance
          Assignee: unassigned at busybox.net
          Reporter: stasos24 at gmail.com
                CC: busybox-cvs at busybox.net
  Target Milestone: ---

Created attachment 9775
  --> https://bugs.busybox.net/attachment.cgi?id=9775&action=edit
crash flags

PoC:
- make defconfig using provided Config.in (added sanitizer flags)
- make
- ln -s ./busybox_unstripped ./awk
- ./ash $(cat ./ash_crash)

Asan Report:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==1961473==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc
0x000000735428 bp 0x7ffe6a3886c0 sp 0x7ffe6a388060 T0)
==1961473==The signal is caused by a READ memory access.
==1961473==Hint: address points to the zero page.
    #0 0x735428 in argstr /busybox_orig/shell/ash.c:6904:23
    #1 0x7372db in evalvar /busybox_orig/shell/ash.c:7690:6
    #2 0x73108f in evalcommand /busybox_orig/shell/ash.c:10429:2
    #3 0x72db50 in evaltree /busybox_orig/shell/ash.c:9389:12
    #4 0x7157e4 in evalstring /busybox_orig/shell/ash.c:13500:7
    #5 0x7124be in ash_main /busybox_orig/shell/ash.c:14753:3
    #6 0x4d67bc in run_applet_no_and_exit
/busybox_orig/libbb/appletlib.c:968:23

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /busybox_orig/shell/ash.c:6904:23 in argstr
==1961473==ABORTING

-- 
You are receiving this mail because:
You are on the CC list for the bug.