Closed
Description
Hi!
Tainted variable rts.datalen is limited by the value INT_MAX:
Line 531 in 4db1de6
Integer value
rts.datalen + 28 is used by calling function malloc without checking its bounds:
Line 578 in 4db1de6
So UBSAN finds integer overflow in:
Line 994 in 4db1de6
where addition to
rts->datalen also occurs.
../ping/ping.c:994:7: runtime error: signed integer overflow: -2147483641 + -1090518520 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../ping/ping.c:994:7 in
Steps to reproduce:
- Build with clang and sanitizers
export CC="clang"
export CFLAGS="-O0 -g -fsanitize=address,undefined"
export LDFLAGS="-O0 -g -fsanitize=address,undefined"
./configure
make
- Configure SAN:
export UBSAN_OPTIONS="log_path=$PWD/ubsan.log:check_initialization_order=1:halt_on_error=0"
export ASAN_OPTIONS="log_path=$PWD/asan.log:detect_leaks=1:check_initialization_order=1:verbosity=0:detect_stack_use_after_return=1:halt_on_error=0"
export LSAN_OPTIONS="log_path=$PWD/lsan.log:halt_on_error=0"
- Run
./ping -s 2147483647 192.168.0.1 cat ubsan.log.xxx
Bug was found by the Svace static analyzer.