heap-buffer-overflow (read outside of buffer) in mrb_vm_exec()
High
S
shopify-scripts
Submitted None
Actions:
Reported by
geeknik
Vulnerability Details
Technical details and impact analysis
Triggered in `3231219` (14 April 2017). Compiled with afl-gcc + asan.
`./mirb < test000`
```
==10555==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200001c920 at pc 0x52be2c bp 0x7ffe6751ada0 sp 0x7ffe6751ad98
READ of size 16 at 0x60200001c920 thread T0
#0 0x52be2b in mrb_vm_exec /root/mruby/src/vm.c:1556
#1 0x530a19 in mrb_vm_run /root/mruby/src/vm.c:829
#2 0x53260f in mrb_run /root/mruby/src/vm.c:2644
#3 0x53260f in ecall /root/mruby/src/vm.c:320
#4 0x4fd59f in mrb_vm_exec /root/mruby/src/vm.c:1716
#5 0x530a19 in mrb_vm_run /root/mruby/src/vm.c:829
#6 0x53260f in mrb_run /root/mruby/src/vm.c:2644
#7 0x53260f in ecall /root/mruby/src/vm.c:320
#8 0x508b65 in mrb_vm_exec /root/mruby/src/vm.c:1170
#9 0x530a19 in mrb_vm_run /root/mruby/src/vm.c:829
#10 0x53260f in mrb_run /root/mruby/src/vm.c:2644
#11 0x53260f in ecall /root/mruby/src/vm.c:320
#12 0x508b65 in mrb_vm_exec /root/mruby/src/vm.c:1170
#13 0x530a19 in mrb_vm_run /root/mruby/src/vm.c:829
#14 0x40781f in main /root/mruby/mrbgems/mruby-bin-mirb/tools/mirb/mirb.c:549
#15 0x7f93c4ea5b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
#16 0x40a71c (/root/mruby/bin/mirb+0x40a71c)
0x60200001c920 is located 0 bytes to the right of 16-byte region [0x60200001c910,0x60200001c920)
allocated by thread T0 here:
#0 0x7f93c55849f6 in __interceptor_realloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x549f6)
#1 0x421a2e in mrb_realloc_simple /root/mruby/src/gc.c:202
#2 0x421a2e in mrb_realloc /root/mruby/src/gc.c:216
#3 0x421a2e in mrb_malloc /root/mruby/src/gc.c:237
SUMMARY: AddressSanitizer: heap-buffer-overflow /root/mruby/src/vm.c:1556 mrb_vm_exec
```
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Heap Overflow