这是indexloc提供的服务,不要输入任何密码
Skip to content

fls crashes with double free or corruption on corrupt image. #905

@adambuchbinder

Description

@adambuchbinder

To reproduce:

$ unzip doublefree.zip
Archive:  doublefree.zip
  inflating: doublefree.img
$ fls doublefree.img
*** Error in `fls': double free or corruption (out): 0x00000000007c0c50 ***

This bug was found using american fuzzy lop and input files ultimately from files.fuzzing-project.org.

Backtrace:

Program received signal SIGABRT, Aborted.
0x00007ffff70f6c37 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007ffff70f6c37 in __GI_raise (sig=sig@entry=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff70fa028 in __GI_abort () at abort.c:89
#2  0x00007ffff71332a4 in __libc_message (do_abort=do_abort@entry=1, 
    fmt=fmt@entry=0x7ffff7245310 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff713f82e in malloc_printerr (ptr=<optimized out>, 
    str=0x7ffff7245440 "double free or corruption (out)", action=1)
    at malloc.c:4998
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0)
    at malloc.c:3842
#5  0x000000000051b92b in ext2fs_dinode_copy (ext2fs=ext2fs@entry=0x7bccf0, 
    fs_meta=0x7bfda0, inum=inum@entry=2, dino_buf=dino_buf@entry=0x7bff20)
    at ext2fs.c:802
#6  0x000000000051ca1e in ext2fs_inode_lookup (fs=0x7bccf0, 
    a_fs_file=0x7bcc80, inum=2) at ext2fs.c:911
#7  0x000000000042547d in tsk_fs_file_open_meta (a_fs=a_fs@entry=0x7bccf0, 
    a_fs_file=a_fs_file@entry=0x0, a_addr=a_addr@entry=2) at fs_file.c:128
#8  0x0000000000529e55 in ext2fs_dir_open_meta (a_fs=0x7bccf0, 
    a_fs_dir=0x7fffffffc470, a_addr=2) at ext2fs_dent.c:310
#9  0x000000000041c9a0 in tsk_fs_dir_open_meta (a_fs=<optimized out>, 
    a_addr=<optimized out>) at fs_dir.c:290
#10 0x000000000041ce01 in tsk_fs_dir_walk_lcl (a_fs=a_fs@entry=0x7bccf0, 
    a_dinfo=a_dinfo@entry=0x7fffffffc550, a_addr=a_addr@entry=2, 
    a_flags=a_flags@entry=(TSK_FS_DIR_WALK_FLAG_ALLOC | TSK_FS_DIR_WALK_FLAG_UNALLOC), a_action=a_action@entry=0x416a50 <print_dent_act>, 
    a_ptr=a_ptr@entry=0x7fffffffd9c0) at fs_dir.c:556
#11 0x000000000041f7a9 in tsk_fs_dir_walk (a_fs=0x7bccf0, a_addr=2, 
    a_flags=<optimized out>, a_action=0x416a50 <print_dent_act>, 
    a_ptr=0x7fffffffd9c0) at fs_dir.c:817
#12 0x0000000000421889 in tsk_fs_dir_walk (a_fs=<optimized out>, 
    a_addr=<optimized out>, a_flags=<optimized out>, 
    a_action=a_action@entry=0x416a50 <print_dent_act>, 
    a_ptr=a_ptr@entry=0x7fffffffd9c0) at fs_dir.c:841
#13 0x000000000041883e in tsk_fs_fls (fs=<optimized out>, 
    lclflags=<optimized out>, inode=<optimized out>, flags=<optimized out>, 
    tpre=<optimized out>, skew=<optimized out>) at fls_lib.c:262
#14 0x00000000004096ff in main (argc=<optimized out>, argv1=<optimized out>)
    at fls.cpp:308

Input: doublefree.zip

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions