#876992 procmail: formail: out-of-bounds read in skipcomment()

Package:
src:procmail
Source:
procmail
Submitter:
Jakub Wilk
Date:
2023-01-07 14:54:02 UTC
Severity:
normal
#876992#3
Date:
2017-09-27 10:53:55 UTC
From:
To:
The skipcomment() function looks like this:

   static const char*skipcomment(start)const char*start;
   { for(;;)
        switch(*++start)
         { case '\0':start--;
           case ')':return start;
           case '\\':start++;
              break;            /* Prithee, breaking the 11th commandment here: */
           case '(':start=skipcomment(start);       /* Thou shalt not re-curse! */
         }
   }

When you pass it a string that ends with backslash, it jumps over the
terminating null byte. :(

To reproduce, rebuild the package with -fsanitize=address, and run:

   $ printf 'From (\\' | formail
   =================================================================
   ==2659==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf5000734 at pc 0x5665d337 bp 0xfffcf038 sp 0xfffcf02c
   READ of size 1 at 0xf5000734 thread T0
       #0 0x5665d336 in skipcomment .../procmail-3.22/src/formisc.c:22
       #1 0x5665d477 in skipwords .../procmail-3.22/src/formisc.c:44
       #2 0x56656071 in getsender .../procmail-3.22/src/formail.c:269
       #3 0x56658fce in main .../procmail-3.22/src/formail.c:628
       #4 0xf6f17285 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18285)
       #5 0x56654860  (.../procmail-3.22/src/formail+0x3860)

   0xf5000734 is located 0 bytes to the right of 4-byte region [0xf5000730,0xf5000734)
   allocated by thread T0 here:
       #0 0xf71e9e14 in malloc (/usr/lib/i386-linux-gnu/libasan.so.4+0xdee14)
       #1 0x5665fa20 in tmalloc .../procmail-3.22/src/ecommon.c:21
       #2 0x56655b61 in getsender .../procmail-3.22/src/formail.c:222
       #3 0x56658fce in main .../procmail-3.22/src/formail.c:628
       #4 0xf6f17285 in __libc_start_main (/lib/i386-linux-gnu/libc.so.6+0x18285)

   ...
#876992#8
Date:
2023-01-05 22:14:39 UTC
From:
To:
forwarded 876992 https://github.com/BuGlessRB/procmail/issues/4
thanks

Thanks for the report. I have "forwarded" it as a github issue
to the above address.

Jakub Wilk escribió:

Could you tell exactly how I do that? (preferably based on the
package for version 3.24-1 which I have just uploaded for unstable
which finally uses dh).

Thanks.
#876992#13
Date:
2023-01-07 14:03:15 UTC
From:
To:
* Santiago Vila <sanvila@debian.org>, 2023-01-05 23:14:

I don't remember how it did it back in 2017, buck today building the
whole package with ASAN enabled turned out out to be surprisingly
difficult.

But it's easy to build just the formail executable for testing:

     make autoconf.h && make formail CFLAGS=-fsanitize=address

Hope this helps!
#876992#18
Date:
2023-01-07 14:51:47 UTC
From:
To:
El 7/1/23 a las 15:03, Jakub Wilk escribió:

Indeed. I also tried without success. There seems to be some special requirement about
the order of compiler flags, or something alike.

Yes, it does. I've added your recipe to the github issue:

https://github.com/BuGlessRB/procmail/issues/4#issuecomment-1374503859

Thanks a lot.