Tar component in busybox version 1.34.1 has a memory leak bug when trying to unpack a tar file.
Ping Lee
spwpun at gmail.com
Wed Dec 1 01:41:59 UTC 2021
Hi~
It seems that I found a bug on busybox version 1.34.1:
In libbb/xfuncs_printf.c:50, malloc twice for archive_handle and
archive_hadle->fileheader with 184 and 72 bytes heap space.
Back to tar_main function, the two
pointers(tar_handle,tar_handle->file_header) hasn't been freed when
return.
Complie cmds:
```
make O=/path/to/build defconfig
make O=/path/to/build menuconfig # and choice ASAN options
cd /path/to/build && make -j4
```
Reproduce cmd:
```
./busybox_unstripped tar -xf test.tar
```
Backtarce in gdb:
```
[#0] 0x555555e7022e → tar_main(argc=0x3, argv=0x7fffffffe430)
[#1] 0x555555b06aac → run_applet_no_and_exit(applet_no=0x148,
name=0x7fffffffe709 "tar", argv=0x7fffffffe430)
[#2] 0x555555b06b6b → run_applet_and_exit(name=0x7fffffffe709 "tar",
argv=0x7fffffffe430)
[#3] 0x555555b067cf → busybox_main(argv=0x7fffffffe430)
[#4] 0x555555b06b29 → run_applet_and_exit(name=0x7fffffffe6f6
"busybox_unstripped", argv=0x7fffffffe428)
[#5] 0x555555b06cbf → main(argc=0x4, argv=0x7fffffffe428)
```
LeakSanitizer log:
```
=================================================================
==120986==ERROR: LeakSanitizer: detected memory leaks
Direct leak of 184 byte(s) in 1 object(s) allocated from:
#0 0x7efda806bb40 in __interceptor_malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
#1 0x555577ed8987 in xmalloc
/home/zy/packages/dhcp-targets/busybox-1.34.1/libbb/xfuncs_printf.c:50
Indirect leak of 72 byte(s) in 1 object(s) allocated from:
#0 0x7efda806bb40 in __interceptor_malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb40)
#1 0x555577ed8987 in xmalloc
/home/zy/packages/dhcp-targets/busybox-1.34.1/libbb/xfuncs_printf.c:50
SUMMARY: AddressSanitizer: 256 byte(s) leaked in 2 allocation(s).
```
The attachment is the tar file to test, it's just a simple tar file.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.busybox.net/pipermail/busybox/attachments/20211201/45386ee4/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.tar
Type: application/x-tar
Size: 10240 bytes
Desc: not available
URL: <http://lists.busybox.net/pipermail/busybox/attachments/20211201/45386ee4/attachment.tar>
More information about the busybox
mailing list