Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2

This vulnerability is of type heap-buffer-overflow. And after quick investigation I think it is very likely to be successfully exploited to remote code execution. The bug exists in latest stable release (radare2-5.6.8) and lastest master branch (5a9e0a19ba07e35382776fed9da2649ac824f526, updated in May 09, 2022). Specifically, the vulnerable code (located at libr/bin/format/mach0/mach0.c) and the bug’s basic explanation are highlighted as follows:

4578                            ut64 page_end_idx = (R_MIN (limit_end, end) - start) / page_size;
4579                            for (; page_idx <= page_end_idx; page_idx++) {
4580                                    if (page_idx >= bin->chained_starts[i]->page_count) {
4581                                            break;
4582                                    }
// Null pointer dereference here.
4583                                    ut16 page_start = bin->chained_starts[i]->page_start[page_idx];
4584                                    if (page_start == DYLD_CHAINED_PTR_START_NONE) {
4585                                            continue;
4586                                    }
4587                                    ut64 cursor = start + page_idx * page_size + page_start;

Build the radare2 (5a9e0a19ba07e35382776fed9da2649ac824f526, updated in May 09, 2022) and run it using the input POC.

# build the radare2 with address sanitizer
export CFLAGS=" -fsanitize=address "; export CXXFLAGS=" -fsanitize=address "; export LDFLAGS=" -fsanitize=address ";
CFGARG=" --enable-shared=no " PREFIX=`realpath install` bash sys/build.sh
# disable some features of address sanitizer to avoid false positives
export ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:symbolize=0:allocator_may_return_null=1:detect_odr_violation=0
# trigger the crash
./radare2 -A -q POC_FILE

The crash stack is:

==17553==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f22529f7d6e bp 0x7ffdf8924410 sp 0x7ffdf8923f40 T0)
==17553==The signal is caused by a READ memory access.
==17553==Hint: address points to the zero page.
    #0 0x7f22529f7d6e  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x4dfd6e)
    #1 0x7f22529b481e  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x49c81e)
    #2 0x7f225653869b  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_io.so+0xc369b)
    #3 0x7f2256d42087  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_util.so+0x229087)
    #4 0x7f2256d2b614  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_util.so+0x212614)
    #5 0x7f22529ef49f  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x4d749f)
    #6 0x7f22529f481b  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x4dc81b)
    #7 0x7f22526f66d9  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x1de6d9)
    #8 0x7f22526f4cd2  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x1dccd2)
    #9 0x7f22526d9b65  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x1c1b65)
    #10 0x7f225267db72  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x165b72)
    #11 0x7f225267cb54  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x164b54)
    #12 0x7f2253910893  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_core.so+0x6c7893)
    #13 0x7f2256acc154  (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_main.so+0x9f154)
    #14 0x7f225683a0b2  (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #15 0x5634bce5339d  (/src/cmdline-fuzz/exprs/radare2-5.5.4/radare2+0x1e39d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/src/cmdline-fuzz/exprs/radare2-5.5.4/src/install/lib/libr_bin.so+0x4dfd6e)
==17553==ABORTING
Aborted