1935984 - Uninitialised value(s) in CERT_DecodeCertFromPackage

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Maurice Dauer [:mdauer]]

OSS-Fuzz: https://oss-fuzz.com/testcase-detail/5627490141274112

Details

Frequent crash that is not reproducible with the single testcase, though I was able to reproduce locally by running afl-fuzz.
The stacktrace for the alloc/free points to a completly different location than the alleged use-after-free. Running with valgrind reveals a lot of uninitialised value errors.

Reproduction

Since valgrind doesn't like ASan, you will need to apply repro.patch and build with ./build.sh -c --fuzz --disable-tests and then run valgrind -s --track-origin=yes /path/to/dist/Debug/bin/nssfuzz-pkcs7 /path/to/testcase.

Stacktrace

==83562==ERROR: AddressSanitizer: heap-use-after-free on address 0x51d0013a2ea0 at pc 0x5d05850252ca bp 0x7ffd67d96ea0 sp 0x7ffd67d96e98
	READ of size 1 at 0x51d0013a2ea0 thread T0
	SCARINESS: 40 (1-byte-read-heap-use-after-free)
	    #0 0x5d05850252c9 in definite_length_decoder nss/lib/util/quickder.c:34:11
	    #1 0x5d05850252c9 in GetItem nss/lib/util/quickder.c:128:18
	    #2 0x5d0585023f3a in DecodeItem nss/lib/util/quickder.c:658:14
	    #3 0x5d0585023bc5 in SEC_QuickDERDecodeItem_Util nss/lib/util/quickder.c:829:14
	    #4 0x5d0584f39b0b in CERT_IssuerNameFromDERCert nss/lib/certdb/certdb.c:267:10
	    #5 0x5d0584fed586 in nssPKIX509_GetIssuerAndSerialFromDER nss/lib/pki/pki3hack.c:264:13
	    #6 0x5d05850013fb in nssCertificateStore_FindCertificateByEncodedCertificate nss/lib/pki/pkistore.c:538:13
	    #7 0x5d0584f74abd in CERT_NewTempCertificate nss/lib/certdb/stanpcertdb.c:368:13
	    #8 0x5d0584693020 in CERT_DecodeCertFromPackage nss/lib/pkcs7/certread.c:527:16
	    #9 0x5d05846862be in LLVMFuzzerTestOneInput nss/fuzz/targets/pkcs7.cc:17:9
	    #10 0x5d0584e9b029 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:423:13
	    #11 0x5d0584e9ac4d in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:311:10
	    #12 0x7945620d8082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
	    #13 0x5d05845adb9d in _start
	
	0x51d0013a2ea0 is located 32 bytes inside of 2048-byte region [0x51d0013a2e80,0x51d0013a3680)
	freed by thread T0 here:
	    #0 0x5d0584646916 in __interceptor_free /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
	    #1 0x5d058506c0fd in FreeArenaList nspr/lib/ds/plarena.c:201:5
	    #2 0x5d058504fca6 in PORT_FreeArena_Util nss/lib/util/secport.c:380:9
	    #3 0x5d0584692cb9 in SEC_ReadCertSequence nss/lib/pkcs7/certread.c:217:9
	    #4 0x5d05846911a4 in CERT_DecodeCertPackage nss/lib/pkcs7/certread.c:365:29
	    #5 0x5d0584692fba in CERT_DecodeCertFromPackage nss/lib/pkcs7/certread.c:524:10
	    #6 0x5d05846862be in LLVMFuzzerTestOneInput nss/fuzz/targets/pkcs7.cc:17:9
	    #7 0x5d0584e9b029 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:423:13
	    #8 0x5d0584e9ac4d in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:311:10
	    #9 0x7945620d8082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
	    #10 0x5d05845adb9d in _start
	
	previously allocated by thread T0 here:
	    #0 0x5d0584646baf in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
	    #1 0x5d058506b595 in PL_ArenaAllocate nspr/lib/ds/plarena.c:132:21
	    #2 0x5d058504f853 in PORT_ArenaAlloc_Util nss/lib/util/secport.c:318:13
	    #3 0x5d058502e904 in sec_asn1d_alloc nss/lib/util/secasn1d.c:327:17
	    #4 0x5d058502e904 in sec_asn1d_zalloc nss/lib/util/secasn1d.c:346:13
	    #5 0x5d058502e904 in sec_asn1d_concat_substrings nss/lib/util/secasn1d.c:2278:39
	    #6 0x5d058502e904 in SEC_ASN1DecoderUpdate_Util nss/lib/util/secasn1d.c:2846:17
	    #7 0x5d058503bd42 in SEC_ASN1Decode_Util nss/lib/util/secasn1d.c:3134:11
	    #8 0x5d058503bd42 in SEC_ASN1DecodeItem_Util nss/lib/util/secasn1d.c:3148:12
	    #9 0x5d0584692bb4 in SEC_ReadCertSequence nss/lib/pkcs7/certread.c:188:9
	    #10 0x5d05846911a4 in CERT_DecodeCertPackage nss/lib/pkcs7/certread.c:365:29
	    #11 0x5d0584692fba in CERT_DecodeCertFromPackage nss/lib/pkcs7/certread.c:524:10
	    #12 0x5d05846862be in LLVMFuzzerTestOneInput nss/fuzz/targets/pkcs7.cc:17:9
	    #13 0x5d0584e9b029 in LLVMFuzzerRunDriver /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:423:13
	    #14 0x5d0584e9ac4d in main /src/aflplusplus/utils/aflpp_driver/aflpp_driver.c:311:10
	    #15 0x7945620d8082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/libc-start.c:308:16
	    #16 0x5d05845adb9d in _start

Comment 1

[Maurice Dauer [:mdauer]]

Attachment: valgrind.log

Comment 2

[Maurice Dauer [:mdauer]]

Attachment: valgrind.log

with --track-origin=yes

Comment 3

[Maurice Dauer [:mdauer]]

Attachment: repro.patch

Comment 4

[Maurice Dauer [:mdauer]]

Attachment: Bug 1935984 - Ensure zero-initialization of collectArgs.cert, r?djackson,#nss-reviewers

Comment 5

[Maurice Dauer [:mdauer]]

https://hg.mozilla.org/projects/nss/rev/a25bcb7b76094cf1331efc366d249f6428b0d911

Comment 6

[Tyson Smith [:tsmith]]

Attachment: advisory.txt