Loading HuntDB...

mirb only: stack-buffer-overflow (OOB write) in main()

High
S
shopify-scripts
Submitted None
Reported by geeknik

Vulnerability Details

Technical details and impact analysis

Stack Overflow
Triggered in `7e28510` (7 April 2017) with `mirb` only. `cat test013.rb | mirb` ``` ==17976==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffeb477fb0 at pc 0x408c21 bp 0x7fffeb477a90 sp 0x7fffeb477a88 WRITE of size 1 at 0x7fffeb477fb0 thread T0 #0 0x408c20 in main /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:466 #1 0x7f96e4703b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) #2 0x40aefc (/root/mruby/bin/mirb+0x40aefc) Address 0x7fffeb477fb0 is located in stack of thread T0 at offset 1184 in frame #0 0x40549f in main /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:361 This frame has 4 object(s): [32, 56) 'args' [96, 126) 'unexpected_end' [160, 1184) 'last_code_line' <== Memory access at offset 1184 overflows this variable [1216, 5312) 'ruby_code' HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:466 main ```

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Stack Overflow