Description

Out-of-bounds Read in function ins_bytes at change.c:968

vim version

git log
commit 9610f94510220c783328e1857af87a6ae7bc20b4 (HEAD -> master, tag: v9.0.0014, origin/master, origin/HEAD)

POC

./afl/src/vim -u NONE -i NONE -n -m -X -Z -e -s -S ./poc_obr4_s.dat -c :qa!
=================================================================
==2965871==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000071b1 at pc 0x000000430bc6 bp 0x7fffffff7a60 sp 0x7fffffff7220
READ of size 1 at 0x6020000071b1 thread T0
    #0 0x430bc5 in strlen (/home/fuzz/fuzz/vim/afl/src/vim+0x430bc5)
    #1 0x54bfbd in ins_bytes /home/fuzz/fuzz/vim/afl/src/change.c:968:27
    #2 0x9bb1cc in ins_compl_stop /home/fuzz/fuzz/vim/afl/src/insexpand.c:2216:6
    #3 0x9b9a65 in ins_compl_prep /home/fuzz/fuzz/vim/afl/src/insexpand.c:2368:15
    #4 0x66f81a in edit /home/fuzz/fuzz/vim/afl/src/edit.c:688:6
    #5 0xb2233b in normal_cmd /home/fuzz/fuzz/vim/afl/src/normal.c:1045:12
    #6 0x8153de in exec_normal /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8812:6
    #7 0x814c08 in exec_normal_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8775:5
    #8 0x8147b9 in ex_normal /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8693:6
    #9 0x7dd739 in do_one_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:2570:2
    #10 0x7ca5f5 in do_cmdline /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:992:17
    #11 0xe5b76e in do_source_ext /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1674:5
    #12 0xe58206 in do_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1801:12
    #13 0xe57b43 in cmd_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1174:14
    #14 0xe5724e in ex_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1200:2
    #15 0x7dd739 in do_one_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:2570:2
    #16 0x7ca5f5 in do_cmdline /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:992:17
    #17 0x7cf271 in do_cmdline_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:586:12
    #18 0x1425db2 in exe_commands /home/fuzz/fuzz/vim/afl/src/main.c:3133:2
    #19 0x1421f4b in vim_main2 /home/fuzz/fuzz/vim/afl/src/main.c:780:2
    #20 0x141745d in main /home/fuzz/fuzz/vim/afl/src/main.c:432:12
    #21 0x7ffff7bee082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #22 0x41ea5d in _start (/home/fuzz/fuzz/vim/afl/src/vim+0x41ea5d)

0x6020000071b1 is located 0 bytes to the right of 1-byte region [0x6020000071b0,0x6020000071b1)
allocated by thread T0 here:
    #0 0x499cbd in malloc (/home/fuzz/fuzz/vim/afl/src/vim+0x499cbd)
    #1 0x4cb392 in lalloc /home/fuzz/fuzz/vim/afl/src/alloc.c:246:11
    #2 0x4cb27a in alloc /home/fuzz/fuzz/vim/afl/src/alloc.c:151:12
    #3 0xf8faad in vim_strnsave /home/fuzz/fuzz/vim/afl/src/strings.c:44:9
    #4 0x9c2a61 in ins_compl_start /home/fuzz/fuzz/vim/afl/src/insexpand.c:4804:23
    #5 0x9c10bb in ins_complete /home/fuzz/fuzz/vim/afl/src/insexpand.c:4932:6
    #6 0x674619 in edit /home/fuzz/fuzz/vim/afl/src/edit.c:1281:10
    #7 0xb2233b in normal_cmd /home/fuzz/fuzz/vim/afl/src/normal.c:1045:12
    #8 0x8153de in exec_normal /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8812:6
    #9 0x814c08 in exec_normal_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8775:5
    #10 0x8147b9 in ex_normal /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:8693:6
    #11 0x7dd739 in do_one_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:2570:2
    #12 0x7ca5f5 in do_cmdline /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:992:17
    #13 0xe5b76e in do_source_ext /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1674:5
    #14 0xe58206 in do_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1801:12
    #15 0xe57b43 in cmd_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1174:14
    #16 0xe5724e in ex_source /home/fuzz/fuzz/vim/afl/src/scriptfile.c:1200:2
    #17 0x7dd739 in do_one_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:2570:2
    #18 0x7ca5f5 in do_cmdline /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:992:17
    #19 0x7cf271 in do_cmdline_cmd /home/fuzz/fuzz/vim/afl/src/ex_docmd.c:586:12
    #20 0x1425db2 in exe_commands /home/fuzz/fuzz/vim/afl/src/main.c:3133:2
    #21 0x1421f4b in vim_main2 /home/fuzz/fuzz/vim/afl/src/main.c:780:2
    #22 0x141745d in main /home/fuzz/fuzz/vim/afl/src/main.c:432:12
    #23 0x7ffff7bee082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/fuzz/fuzz/vim/afl/src/vim+0x430bc5) in strlen
Shadow bytes around the buggy address:
  0x0c047fff8de0: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c047fff8df0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8e00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 02 fa
  0x0c047fff8e10: fa fa 00 fa fa fa 02 fa fa fa fd fa fa fa fd fa
  0x0c047fff8e20: fa fa 04 fa fa fa 02 fa fa fa 02 fa fa fa fd fa
=>0x0c047fff8e30: fa fa 01 fa fa fa[01]fa fa fa 01 fa fa fa 03 fa
  0x0c047fff8e40: fa fa 06 fa fa fa fd fa fa fa fd fa fa fa 00 07
  0x0c047fff8e50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff8e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2965871==ABORTING

poc_obr4_s.dat