| Change 621067117 by sungyc@sungyc:fig-export-icing-153-change-479:7398:citc on 2024/04/01 23:29:44 |
| |
| [hunspell][vulnerability fix] Fix memory freeing on uninitialized address value |
| |
| ## Test plan |
| ``` |
| sso_client -location 'https://clusterfuzz.corp.google.com/testcase-detail/download-testcase?id=5472705942454272' > /tmp/testcase-5472705942454272 && \ |
| blaze --blazerc=/dev/null test -c opt --config=fuzztest-msan --copt=-DNDEBUG \ |
| --test_strategy=local \ |
| --test_sharding_strategy=disabled \ |
| --test_env=FUZZTEST_REPLAY=/tmp/testcase-5472705942454272 \ |
| --test_filter=LLVMFuzzer.TestOneInput \ |
| //third_party/hunspell/fuzzers:dict_fuzzer |
| ``` |
| |
| ## Description |
| This bug is "use-of-uninitialized-value", caused by using (freeing) uninitialized address in `reptable[j].pattern`. |
| - Use calloc for `reptable` to initialize all members to 0, so `reptable[j].pattern` will have NULL value. |
| - Add NULL check before `free()`. |
| - Change `reptable[j].pattern` to NULL after `free()`, to avoid double free error (except for destructor). |
| |
| PRESUBMIT=passed |
| BUG=325665488 |
| R=mghiware |
| APPROVED=mghiware |
| REQUIRED_REVIEW=1 |
| DELTA=11 (8 added, 0 deleted, 3 changed) |
| DELTA_BY_EXTENSION=cxx=11 |
| OCL=621036222 |
| FIG_CHANGESET=ed6bff931bde83fdddfff0d9a7e060af03209ee2 |
| FIG_WORKSPACE=sungyc/153:icing |
| MARKDOWN=true |
| |
| Affected files ... |
| |
| ... //depot//src/hunspell/affixmgr.cxx#19 edit |
| |
| ==== //depot//src/hunspell/affixmgr.cxx#18 - /google/src/files/621067117/depot//src/hunspell/affixmgr.cxx ==== |
| --- /google/src/files/615029530/depot//src/hunspell/affixmgr.cxx 2024-03-12 10:13:27.000000000 -0400 |
| +++ /google/src/files/621067117/depot//src/hunspell/affixmgr.cxx 2024-04-02 02:29:44.000000000 -0400 |
| @@ -179,9 +179,13 @@ |
| numbreak = 0; |
| if (reptable) { |
| for (int j=0; j < numrep; j++) { |
| + if (reptable[j].pattern) { |
| free(reptable[j].pattern); |
| + } |
| + if (reptable[j].pattern2) { |
| free(reptable[j].pattern2); |
| } |
| + } |
| free(reptable); |
| reptable = NULL; |
| } |
| @@ -3601,7 +3605,7 @@ |
| HUNSPELL_WARNING(stderr, "error: line %d: incorrect entry number\n", af->getlinenum()); |
| return 1; |
| } |
| - reptable = (replentry *) malloc(numrep * sizeof(struct replentry)); |
| + reptable = (replentry *) calloc(numrep, sizeof(replentry)); |
| if (!reptable) return 1; |
| np++; |
| break; |
| @@ -3661,9 +3665,13 @@ |
| for (int k=0; k < j; k++) { |
| free(reptable[k].pattern); |
| free(reptable[k].pattern2); |
| + reptable[k].pattern = NULL; |
| + reptable[k].pattern2 = NULL; |
| } |
| if (reptable[j].pattern) free(reptable[j].pattern); |
| if (reptable[j].pattern2) free(reptable[j].pattern2); |
| + reptable[j].pattern = NULL; |
| + reptable[j].pattern2 = NULL; |
| numrep = 0; |
| return 1; |
| } |
