Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed buffer overflow in Utils::Md5::hexdigest() #2002

Conversation

defanator
Copy link
Contributor

Found via failed test (auditlog.json) on Alpine Linux 3.8.2:

$ cat test/test-cases/regression/auditlog.json.log
:test-result: PASS auditlog.json:auditlog : basic parser test - Parallel
test/test-suite.sh: line 14: 23740 Segmentation fault      (core dumped) $VALGRIND $PARAM ./regression_tests ../$FILE:$i
:test-result: FAIL segfault: .././test/test-cases/regression/auditlog.json:1
./regression_tests .././test/test-cases/regression/auditlog.json:1
:test-result: PASS auditlog.json:auditlog : basic parser test - Serial

./regression_tests .././test/test-cases/regression/auditlog.json:2

Backtrace:

Core was generated by `./regression_tests .././test/test-cases/regression/auditlog.json:1'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f4637b6bb8d in __stack_chk_fail () from /lib/ld-musl-x86_64.so.1
(gdb) bt
#0  0x00007f4637b6bb8d in __stack_chk_fail () from /lib/ld-musl-x86_64.so.1
#1  0x00005620f24b78c0 in modsecurity::Utils::Md5::hexdigest (input=...) at utils/md5.cc:22
#2  0x00005620f249115f in modsecurity::audit_log::writer::Parallel::write (this=0x5620f35fd060, transaction=0x5620f3606b60, parts=<optimized out>, error=0x7ffc0067f378)
    at audit_log/writer/parallel.cc:173
#3  0x00005620f249012d in modsecurity::audit_log::AuditLog::saveIfRelevant (this=0x7f4636c332e0, transaction=transaction@entry=0x5620f3606b60, parts=parts@entry=4430)
    at audit_log/audit_log.cc:326
#4  0x00005620f2482d54 in modsecurity::Transaction::processLogging (this=0x5620f3606b60) at transaction.cc:1302
#5  0x00005620f247e7fa in perform_unit_test (test=0x7ffc0067fc68, tests=<optimized out>, res=0x7ffc0067fc08, count=0x7ffc0067fa4c) at regression/regression.cc:348
#6  0x00005620f247b545 in main (argc=<optimized out>, argv=<optimized out>) at regression/regression.cc:500
(gdb) 

Found via failed test (auditlog.json) on Alpine Linux 3.8.2.
zimmerle added a commit that referenced this pull request Jan 14, 2019
@zimmerle zimmerle self-assigned this Jan 14, 2019
@zimmerle zimmerle self-requested a review January 14, 2019 19:31
@zimmerle zimmerle added the 3.x Related to ModSecurity version 3.x label Jan 14, 2019
@zimmerle
Copy link
Contributor

Merged. Thanks.

@zimmerle zimmerle closed this Jan 14, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
3.x Related to ModSecurity version 3.x
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants