<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div><div>Package: libedit2<br></div><div>Version: 3.1-20181209-1<br></div></div><div><div><br></div><div>Hello.<br></div><div>Found a bug in libedit package which causes readline() to segfault after writting a large amount of data.<br></div><div>It crashes somewhere in function e_wgets() called from e_gets() from readline().<br></div><div>Looks like a buffer overflow, but appears to be crashing after trying to derreference a null pointer<br></div><div>I don't think this would represent a security issue even if it is exploitable in some way, but i report it just in case.<br></div><div><div><br></div><div>Bug appears to be fixed in newer versions of the lib, solved by building from source and installing the sid release of package <br></div><div>"libedit2_3.1-20191231-1_amd64.deb".<br></div><div><br></div></div><div>Proof of concept:<br></div><div><span class="font" style="font-family: monospace, sans-serif;"><br></span><span class="font" style="font-family: monospace, sans-serif;">readline.c:</span><span class="font" style="font-family: monospace, sans-serif;"><br></span><span class="font" style="font-family: monospace, sans-serif;">----------------------------------------</span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;">/* gcc readline.c -o readline -ledit */</span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;">#include <editline/readline.h></span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div></div><div><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;">int main(int argc, char **argv)</span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;">{</span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;"> readline("Give me a line: ");</span><span class="font" style="font-family: monospace, sans-serif;"><br></span></div><div><span class="font" style="font-family: monospace, sans-serif;">}<br>----------------------------------------<br><br><br>poc.py:<br>----------------------------------------<br></span>#!/usr/bin/env python3 <br></div><div><br></div><div>import pty<br></div><div>import os<br></div><div><br></div><div>def read(fd):<br></div><div>data = os.read(fd, 1024)<br></div><div>if data.decode().find('Give me a line') != -1:<br></div><div>os.write(fd, bytes("A"*1000, 'ascii'))<br></div><div>return data<br></div><div><br></div><div>r = pty.spawn([os.getcwd() + '/readline'], read)<br></div><div><br></div><div>if r & 0xF == 11:<br></div><div>print ("\nGot SIGSEGV")<span class="font" style="font-family: monospace, sans-serif;"><br>----------------------------------------<br><br>Output:<br>----------------------------------------<br>gcc readline.c -o readline -ledit && python3 poc.py<br>Give me a line: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA<br>AAAAAAAAAAA<br>Got SIGSEGV<br>-----------------------------------------</span></div><div></div> </body>
</html>