Skip to content

Commit 921f1be

Browse files
maagemaage
committed
bugfix: xmlfilecontent_probe: process_file ptr mixup
libxml2 does use <= when comparing nodeNr and 0. node line depends on node type, we need to use function to find it. See: https://github.com/tenderlove/libxml2/blob/ecb5d5afdc8acceba608524f6e98c361fd2ce0e9/tree.c#L4507 253/265 Test: probes/xmlfilecontent/test_xmlfilecontent_probe.sh Command: "/builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/tests/probes/xmlfilecontent/test_xmlfilecontent_probe.sh" Directory: /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/redhat-linux-build/tests/probes/xmlfilecontent "probes/xmlfilecontent/test_xmlfilecontent_probe.sh" start time: Sep 04 20:13 EEST Output: ---------------------------------------------------------- ================================================================= ==866168==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6080003efd90 at pc 0x7fdbf2623c59 bp 0x7fdbe7ab8430 sp 0x7fdbe7ab8428 READ of size 2 at 0x6080003efd90 thread T8 #0 0x7fdbf2623c58 in process_file.isra.0 /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/independent/xm lfilecontent_probe.c:307 #1 0x7fdbf25dba5a in xmlfilecontent_probe_main /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/independ ent/xmlfilecontent_probe.c:397 #2 0x7fdbf25c2087 in probe_worker /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/probe/worker.c:1114 #3 0x7fdbf25bc44f in probe_worker_runfn /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/probe/worker.c: 97 #4 0x7fdbf208ce2c in start_thread (/lib64/libc.so.6+0x8ce2c) #5 0x7fdbf21121af in clone3 (/lib64/libc.so.6+0x1121af) 0x6080003efd90 is located 16 bytes to the right of 96-byte region [0x6080003efd20,0x6080003efd80) allocated by thread T8 here: #0 0x7fdbf28ba68f in __interceptor_malloc (/lib64/libasan.so.8+0xba68f) #1 0x7fdbf22cdb63 in xmlNewPropInternal.lto_priv.0 (/lib64/libxml2.so.2+0x57b63) Thread T8 created by T7 here: #0 0x7fdbf284b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x7fdbf25bf673 in probe_input_handler /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/probe/input_handler.c:183 #2 0x7fdbf208ce2c in start_thread (/lib64/libc.so.6+0x8ce2c) Thread T7 created by T5 here: #0 0x7fdbf284b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x7fdbf25be1d0 in probe_common_main /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/probe/probe_main.c:256 #2 0x7fdbf208ce2c in start_thread (/lib64/libc.so.6+0x8ce2c) Thread T5 created by T0 here: #0 0x7fdbf284b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x7fdbf253b6a0 in sch_queue_connect /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/SEAP/sch_queue.c:62 #2 0x7fdbf253b6a0 in SEAP_connect /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/SEAP/seap.c:116 #3 0x7fdbf253b6a0 in oval_probe_comm /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_probe_ext.c:443 #4 0x7fdbf2543e1d in oval_probe_ext_eval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_probe_ext.c:980 #5 0x7fdbf2543e1d in oval_probe_ext_handler /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_probe_ext.c:858 #6 0x7fdbf2545af4 in oval_probe_query_object /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_probe.c:156 #7 0x7fdbf255bf83 in oval_probe_query_test /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_probe.c:257 #8 0x7fdbf255bf83 in _oval_result_test_result /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultTest.c:1031 #9 0x7fdbf255bf83 in oval_result_test_eval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultTest.c:1152 #10 0x7fdbf255c67f in _oval_result_criteria_node_result /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultCriteriaNode.c:367 #11 0x7fdbf255c67f in oval_result_criteria_node_eval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultCriteriaNode.c:390 #12 0x7fdbf255c61c in _oval_result_criteria_node_result /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultCriteriaNode.c:358 #13 0x7fdbf255c61c in oval_result_criteria_node_eval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultCriteriaNode.c:390 #14 0x7fdbf255c835 in oval_result_definition_eval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultDefinition.c:165 #15 0x7fdbf255cae8 in oval_result_system_eval_definition /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/results/oval_resultSystem.c:373 #16 0x7fdbf2502951 in oval_agent_eval_system /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_agent.c:286 #17 0x7fdbf250ac0b in oval_session_evaluate /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/oval_session.c:372 #18 0x55cf5fd8b858 in app_evaluate_oval /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/utils/oscap-oval.c:360 #19 0x55cf5fd94b86 in oscap_module_call /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/utils/oscap-tool.c:295 #20 0x55cf5fd94b86 in oscap_module_process /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/utils/oscap-tool.c:389 #21 0x55cf5fd81d4e in main /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/utils/oscap.c:88 #22 0x7fdbf202954f in __libc_start_call_main (/lib64/libc.so.6+0x2954f) SUMMARY: AddressSanitizer: heap-buffer-overflow /builddir/build/BUILD/openscap-f81da4bd66dbe528ffa6be16aca36b93f3eec0a5/src/OVAL/probes/independent/xmlfilecontent_probe.c:307 in process_file.isra.0 Shadow bytes around the buggy address: 0x0c1080075f60: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075f70: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075f80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075f90: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075fa0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c1080075fb0: fa fa[fa]fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075fc0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075fd0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075fe0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa 0x0c1080075ff0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1080076000: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==866168==ABORTING
1 parent 5cc71dd commit 921f1be

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

‎src/OVAL/probes/independent/xmlfilecontent_probe.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ static int process_file(const char *prefix, const char *path, const char *filena
296296

297297
node_cnt = nodes->nodeNr;
298298
dD("node_cnt: %d.", node_cnt);
299-
if (node_cnt == 0) {
299+
if (node_cnt <= 0) {
300300
probe_item_setstatus(item, SYSCHAR_STATUS_DOES_NOT_EXIST);
301301
probe_item_ent_add(item, "value_of", NULL, NULL);
302302
probe_itement_setstatus(item, "value_of", 1, SYSCHAR_STATUS_DOES_NOT_EXIST);
@@ -305,7 +305,7 @@ static int process_file(const char *prefix, const char *path, const char *filena
305305
for (i = 0; i < node_cnt; ++i) {
306306
cur_node = node_tab[i];
307307
dD("node[%d] line: %d, name: '%s', type: %d.",
308-
i, cur_node->line, cur_node->name, cur_node->type);
308+
i, XML_GET_LINE(cur_node), cur_node->name, cur_node->type);
309309
if (cur_node->type == XML_ATTRIBUTE_NODE
310310
|| cur_node->type == XML_TEXT_NODE) {
311311
xmlChar *value;

0 commit comments

Comments
 (0)