portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initialize retctx,ctx before freeing the inner elements

Browse source 
In rz_core_analysis_type_match retctx structure was initialized on the
stack only after a "goto out_function", where a field of that structure
was freed. When the goto path is taken, the field is not properly
initialized and it cause cause a crash of Rizin or have other effects.

Fixes: CVE-2021-4022
This commit is contained in:
Riccardo Schirone 2021-11-26 16:01:48 +01:00 committed by Anton Kochkov
parent 4295cfe046
commit 21584e416c
3 changed files with 21 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
librz/analysis/var.c
View file

@ -1103,13 +1103,15 @@ RZ_API void rz_analysis_extract_rarg(RzAnalysis *analysis, RzAnalysisOp *op, RzA
RZ_API void rz_analysis_extract_vars(RzAnalysis *analysis, RzAnalysisFunction *fcn, RzAnalysisOp *op) {
rz_return_if_fail(analysis && fcn && op);
const char *BP = analysis->reg->name[RZ_REG_NAME_BP];
const char *SP = analysis->reg->name[RZ_REG_NAME_SP];
const char *BP = rz_reg_get_name(analysis->reg, RZ_REG_NAME_BP);
const char *SP = rz_reg_get_name(analysis->reg, RZ_REG_NAME_SP);
if (BP) {
extract_arg(analysis, fcn, op, BP, "+", RZ_ANALYSIS_VAR_KIND_BPV);
extract_arg(analysis, fcn, op, BP, "-", RZ_ANALYSIS_VAR_KIND_BPV);
}
extract_arg(analysis, fcn, op, SP, "+", RZ_ANALYSIS_VAR_KIND_SPV);
if (SP) {
extract_arg(analysis, fcn, op, SP, "+", RZ_ANALYSIS_VAR_KIND_SPV);
}
}
static RzList *var_generate_list(RzAnalysis *a, RzAnalysisFunction *fcn, int kind) {

25
librz/core/analysis_tp.c
View file

@ -843,6 +843,19 @@ RZ_API void rz_core_analysis_type_match(RzCore *core, RzAnalysisFunction *fcn, H
dtrace->ht = ht_pp_new_size(fcn->ninstr, opt.dupvalue, opt.freefn, opt.calcsizeV);
dtrace->ht->opt = opt;
// Create a new context to store the return type propagation state
struct ReturnTypeAnalysisCtx retctx = {
.resolved = false,
.ret_type = NULL,
.ret_reg = NULL,
};
struct TypeAnalysisCtx ctx = {
.retctx = &retctx,
.cur_idx = 0,
.prev_dest = NULL,
.str_flag = false
};
HtUP *op_cache = NULL;
const char *pc = rz_reg_get_name(core->dbg->reg, RZ_REG_NAME_PC);
if (!pc) {
@ -856,18 +869,6 @@ RZ_API void rz_core_analysis_type_match(RzCore *core, RzAnalysisFunction *fcn, H
rz_list_sort(fcn->bbs, bb_cmpaddr);
// TODO: The algorithm can be more accurate if blocks are followed by their jmp/fail, not just by address
RzAnalysisBlock *bb;
// Create a new context to store the return type propagation state
struct ReturnTypeAnalysisCtx retctx = {
.resolved = false,
.ret_type = NULL,
.ret_reg = NULL
};
struct TypeAnalysisCtx ctx = {
.retctx = &retctx,
.cur_idx = 0,
.prev_dest = NULL,
.str_flag = false
};
rz_list_foreach (fcn->bbs, it, bb) {
ut64 addr = bb->addr;
rz_reg_set_value(core->dbg->reg, r, addr);

3
librz/core/canalysis.c
View file

@ -5371,6 +5371,9 @@ RZ_API void rz_core_analysis_esil(RzCore *core, const char *str, const char *tar
rz_core_analysis_esil_init_mem(core, NULL, UT64_MAX, UT32_MAX);
}
const char *spname = rz_reg_get_name(core->analysis->reg, RZ_REG_NAME_SP);
if (!spname) {
goto out_pop_regs;
}
EsilBreakCtx ctx = {
&op,
fcn,