Pożyczony & zapomniany kod – dlaczego tego nie robić?

Krótka historyjka

Mimo, że tytuł posta jest dosyć oczywisty – porusza on całkiem poważny problem wielu projektów open-source i nie tylko.

Używamy cudzy kod, rozwijamy własny projekt, generalnie wszystko jest całkiem okej. Po pewnym czasie skupiamy się na funkcjonalnościach i problemach doraźnych, wiedząc, że “pożyczony” kod sobie działa i spełnia nasze oczekiwania. Mija nawet kilka lat, kod sobie dalej działa a priorytety projektu (i jego rozmiar) znacząco, lub nie, zostały zmienione i prawdopodobnie zmierzamy ku całkiem innemu celowi, niż pierwotnie zakładaliśmy.

Dlaczego zaczynam tak “na około”? Dlatego, że ta historia, całkiem niedawno dotknęła projekt radare2 (pisałem o nim m.in. tutaj). Efekt: cztery błędy związane tylko i wyłącznie z pożyczonym kodem z projektu GRUB. Kod ma ponad czteroletnią historię (okolice listopada 2013) i jest załatany od jakiegoś czasu w oficjalnym repozytorium projektu.

Morał z historyjki, w czterech częściach

Lista wyżej przytoczonych błędów w kolejności od “dotkliwości” problemu:

#1. Stack buffer underflow

radare2 Git HEAD: ad764839b20818d629131d4e07bda0038f9d747f

ASAN:

==32384==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd57d028f8 at pc 0x7fc9c5b6ac47 bp 0x7ffd57d01c40 sp 0x7ffd57d01c38
WRITE of size 16 at 0x7ffd57d028f8 thread T0
    #0 0x7fc9c5b6ac46 in grub_memmove XYZ/radare2/shlr/grub/kern/misc.c:98:7
    #1 0x7fc9c5b67800 in grub_disk_read XYZ/radare2/shlr/grub/kern/disk.c:488:3
    #2 0x7fc9c5b68268 in grub_disk_read_ex XYZ/radare2/shlr/grub/kern/disk.c:563:12
    #3 0x7fc9c5b0754d in grub_fshelp_read_file XYZ/radare2/shlr/grub/fs/fshelp.c:333:4
    #4 0x7fc9c5b1134d in grub_ext2_read_file XYZ/radare2/shlr/grub/fs/ext2.c:504:9
    #5 0x7fc9c5b1134d in grub_ext2_iterate_dir XYZ/radare2/shlr/grub/fs/ext2.c:690
    #6 0x7fc9c5b0faf2 in grub_ext2_dir XYZ/radare2/shlr/grub/fs/ext2.c:876:3
    #7 0x7fc9c5af0c58 in ext2__mount XYZ/radare2/libr/fs/p/fs_grub_base.c:74:8
    #8 0x7fc9c5afbeaa in r_fs_mount XYZ/radare2/libr/fs/fs.c:151:7
    #9 0x7fc9c8f20dfb in cmd_mount XYZ/radare2/libr/core/./cmd_mount.c:49:9
    #10 0x7fc9c90e76af in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:226:10
    #11 0x7fc9c8fd5811 in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2191:12
    #12 0x7fc9c8f1d5b7 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1395:9
    #13 0x7fc9c8f16d24 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2799:9
    #14 0x7fc9c8f0183f in r_core_cmdf XYZ/radare2/libr/core/cmd.c:2957:8
    #15 0x7fc9c90c1752 in bin_info XYZ/radare2/libr/core/cbin.c:621:4
    #16 0x7fc9c90c1752 in r_core_bin_info XYZ/radare2/libr/core/cbin.c:2870
    #17 0x7fc9c90b1e41 in r_core_bin_set_env XYZ/radare2/libr/core/cbin.c:115:3
    #18 0x7fc9c903d974 in r_core_file_do_load_for_io_plugin XYZ/radare2/libr/core/file.c:434:2
    #19 0x7fc9c903d974 in r_core_bin_load XYZ/radare2/libr/core/file.c:567
    #20 0x555f8a113f6b in main XYZ/radare2/binr/radare2/radare2.c:952:14
    #21 0x7fc9c1bc782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #22 0x555f8a043f38 in _start (/usr/local/bin/radare2+0x20f38)

ASAN:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting

GitHub Issue #7683

Commit naprawiający

CVE: CVE-2017-9949

#2. Excessive stack usage (zmienna przepełniająca ramkę stosu)

radare2 Git HEAD: ba25be4934ecd65b71170f7381655325157bde09

ASAN:

==13184==ERROR: AddressSanitizer: stack-overflow on address 0x7ffcef7dce98 (pc 0x7f9c7499cecc bp 0x7ffcf37dcf70 sp 0x7ffcef7dcea0 T0)
    #0 0x7f9c7499cecb in grub_ext2_read_block XYZ/radare2/shlr/grub/fs/ext2.c:389:4
    #1 0x7f9c74991326 in grub_fshelp_read_file XYZ/radare2/shlr/grub/fs/fshelp.c:305:15
    #2 0x7f9c7499b116 in grub_ext2_read_file XYZ/radare2/shlr/grub/fs/ext2.c:504:9
    #3 0x7f9c7499b116 in grub_ext2_iterate_dir XYZ/radare2/shlr/grub/fs/ext2.c:672
    #4 0x7f9c749999a1 in grub_ext2_dir XYZ/radare2/shlr/grub/fs/ext2.c:882:3
    #5 0x7f9c7497ae95 in ext2__mount XYZ/radare2/libr/fs/p/fs_grub_base.c:74:8
    #6 0x7f9c74985fc4 in r_fs_mount XYZ/radare2/libr/fs/fs.c:151:7
    #7 0x7f9c77d7537d in cmd_mount XYZ/radare2/libr/core/./cmd_mount.c:49:9
    #8 0x7f9c77f3a25c in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:226:10
    #9 0x7f9c77e28ae1 in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2156:12
    #10 0x7f9c77d70d1e in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1360:9
    #11 0x7f9c77d6a626 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2764:9
    #12 0x7f9c77d555ad in r_core_cmdf XYZ/radare2/libr/core/cmd.c:2922:8
    #13 0x7f9c77f142d7 in bin_info XYZ/radare2/libr/core/cbin.c:621:4
    #14 0x7f9c77f142d7 in r_core_bin_info XYZ/radare2/libr/core/cbin.c:2873
    #15 0x7f9c77f04fd0 in r_core_bin_set_env XYZ/radare2/libr/core/cbin.c:115:3
    #16 0x7f9c77e8e263 in r_core_file_do_load_for_io_plugin XYZ/radare2/libr/core/file.c:434:2
    #17 0x7f9c77e8e263 in r_core_bin_load XYZ/radare2/libr/core/file.c:567
    #18 0x556a34e7013d in main XYZ/radare2/binr/radare2/radare2.c:952:14
    #19 0x7f9c70671510 in __libc_start_main (/usr/lib/libc.so.6+0x20510)
    #20 0x556a34d7ce29 in _start (/usr/local/bin/radare2+0x20e29)

SUMMARY: AddressSanitizer: stack-overflow XYZ/radare2/shlr/grub/fs/ext2.c:389:4 in grub_ext2_read_block
==13184==ABORTING

GitHub Issue #7723

Commit naprawiający

CVE: CVE-2017-9763

#3. FPE (dzielenie przez zero)

radare2 Git HEAD: 90ffb5463df15326cd8261da99b85597d4eb6b3b

==10375==ERROR: AddressSanitizer: FPE on unknown address 0x7fb2f4af4726 (pc 0x7fb2f4af4726 bp 0x7fff41d52850 sp 0x7fff41d52720 T0)
#0 0x7fb2f4af4725 in grub_ext2_read_inode XYZ/radare2/shlr/grub/fs/ext2.c:525:29
#1 0x7fb2f4af2ce4 in grub_ext2_mount XYZ/radare2/shlr/grub/fs/ext2.c:593:3
#2 0x7fb2f4af19ac in grub_ext2_dir XYZ/radare2/shlr/grub/fs/ext2.c:863:10
#3 0x7fb2f4ad2c58 in ext2__mount XYZ/radare2/libr/fs/p/fs_grub_base.c:74:8
#4 0x7fb2f4addeaa in r_fs_mount XYZ/radare2/libr/fs/fs.c:151:7
#5 0x7fb2f7ef996b in cmd_mount XYZ/radare2/libr/core/./cmd_mount.c:49:9
#6 0x7fb2f80be7df in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:226:10
#7 0x7fb2f7faddeb in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2178:12
#8 0x7fb2f7ef6127 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1368:9
#9 0x7fb2f7eef8b9 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2786:9
#10 0x7fb2f7eda74f in r_core_cmdf XYZ/radare2/libr/core/cmd.c:2942:8
#11 0x7fb2f8098e42 in bin_info XYZ/radare2/libr/core/cbin.c:621:4
#12 0x7fb2f8098e42 in r_core_bin_info XYZ/radare2/libr/core/cbin.c:2870
#13 0x7fb2f8089531 in r_core_bin_set_env XYZ/radare2/libr/core/cbin.c:115:3
#14 0x7fb2f8015064 in r_core_file_do_load_for_io_plugin XYZ/radare2/libr/core/file.c:434:2
#15 0x7fb2f8015064 in r_core_bin_load XYZ/radare2/libr/core/file.c:567
#16 0x55e7cf695f6b in main XYZ/radare2/binr/radare2/radare2.c:952:14
#17 0x7fb2f0bae82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#18 0x55e7cf5c5f38 in _start (/usr/local/bin/radare2+0x20f38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE XYZ/radare2/shlr/grub/fs/ext2.c:525:29 in grub_ext2_read_inode
==10375==ABORTING

GitHub Issue #7650

Commit naprawiający

CVE: N/A

#4. FPE (modulo przez zero)

radare2 Git HEAD: 4ae632133ed34c7f80949a8a705635608a4ac45d

==1943==ERROR: AddressSanitizer: FPE on unknown address 0x7f5778308fd5 (pc 0x7f5778308fd5 bp 0x7fff9b7706a0 sp 0x7fff9b7705a0 T0)
#0 0x7f5778308fd4 in grub_ext2_read_inode XYZ/radare2/shlr/grub/fs/ext2.c:530:5
#1 0x7f5778307eb8 in grub_ext2_mount XYZ/radare2/shlr/grub/fs/ext2.c:582:3
#2 0x7f577830718f in grub_ext2_dir XYZ/radare2/shlr/grub/fs/ext2.c:848:10
#3 0x7f57782f55d8 in ext2__mount XYZ/radare2/libr/fs/p/fs_grub_base.c:74:8
#4 0x7f57782fd357 in r_fs_mount XYZ/radare2/libr/fs/fs.c:141:7
#5 0x7f577af9af12 in cmd_mount XYZ/radare2/libr/core/./cmd_mount.c:57:9
#6 0x7f577b0801fc in r_cmd_call XYZ/radare2/libr/core/cmd_api.c:213:10
#7 0x7f577afccbea in r_core_cmd_subst_i XYZ/radare2/libr/core/cmd.c:2039:16
#8 0x7f577af98f67 in r_core_cmd_subst XYZ/radare2/libr/core/cmd.c:1332:9
#9 0x7f577af95f85 in r_core_cmd XYZ/radare2/libr/core/cmd.c:2595:9
#10 0x7f577af8b538 in r_core_cmdf XYZ/radare2/libr/core/cmd.c:2735:8
#11 0x7f577b069581 in bin_info XYZ/radare2/libr/core/cbin.c:593:4
#12 0x7f577b066f0e in r_core_bin_info XYZ/radare2/libr/core/cbin.c:2610:45
#13 0x7f577b066d3d in r_core_bin_set_env XYZ/radare2/libr/core/cbin.c:109:3
#14 0x7f577b02d645 in r_core_file_do_load_for_io_plugin XYZ/radare2/libr/core/file.c:409:2
#15 0x7f577b02b8ef in r_core_bin_load XYZ/radare2/libr/core/file.c:527:4
#16 0x5586a8089593 in main XYZ/radare2/binr/radare2/radare2.c:822:14
#17 0x7f57748fe82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#18 0x5586a7fbbe58 in _start (/usr/local/bin/radare2+0x20e58)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE XYZ/radare2/shlr/grub/fs/ext2.c:530:5 in grub_ext2_read_inode
==1943==ABORTING

GitHub Issue #6327

Commit naprawiający

CVE: N/A