[MXS-1304] Invalid write in gw_str_xor Created: 2017-06-28  Updated: 2017-06-28  Resolved: 2017-06-28

Status: Closed
Project: MariaDB MaxScale
Component/s: Core
Affects Version/s: 2.1.3
Fix Version/s: 2.1.4

Type: Bug Priority: Blocker
Reporter: markus makela Assignee: markus makela
Resolution: Fixed Votes: 0
Labels: None


 Description   

==31899==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd556a96a4 at pc 0x7f92af9d29cd bp 0x7ffd556a9540 sp 0x7ffd556a9530
WRITE of size 1 at 0x7ffd556a96a4 thread T0
    #0 0x7f92af9d29cc in gw_str_xor /home/markusjm/MaxScale/server/core/utils.c:227
    #1 0x7f92a5456313 in load_hashed_password /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1231
    #2 0x7f92a5457030 in gw_send_backend_auth /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1393
    #3 0x7f92a4803948 in gw_read_backend_event /home/markusjm/MaxScale/server/modules/protocol/MySQL/MySQLBackend/mysql_backend.c:485
    #4 0x7f92af9b4f01 in process_pollq /home/markusjm/MaxScale/server/core/poll.c:999
    #5 0x7f92af9b3cd6 in poll_waitevents /home/markusjm/MaxScale/server/core/poll.c:777
    #6 0x40a66c in main /home/markusjm/MaxScale/server/core/gateway.cc:2035
    #7 0x7f92ad8cc400 in __libc_start_main (/lib64/libc.so.6+0x20400)
    #8 0x404469 in _start (/home/markusjm/build/bin/maxscale+0x404469)
 
Address 0x7ffd556a96a4 is located in stack of thread T0 at offset 244 in frame
    #0 0x7f92a54560ee in load_hashed_password /home/markusjm/MaxScale/server/modules/protocol/MySQL/mysql_common.c:1215
 
  This frame has 4 object(s):
    [32, 52) 'hash1'
    [96, 116) 'hash2'
    [160, 180) 'new_sha'
    [224, 244) 'client_scramble' <== Memory access at offset 244 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/markusjm/MaxScale/server/core/utils.c:227 in gw_str_xor
Shadow bytes around the buggy address:
  0x10002aacd280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002aacd290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002aacd2a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002aacd2b0: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 04 f4 f2 f2
  0x10002aacd2c0: f2 f2 00 00 04 f4 f2 f2 f2 f2 00 00 04 f4 f2 f2
=>0x10002aacd2d0: f2 f2 00 00[04]f4 00 00 00 00 00 00 00 00 00 00
  0x10002aacd2e0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f4
  0x10002aacd2f0: f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
  0x10002aacd300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002aacd310: 00 00 00 00 00 00 00 00 00 00 00 00 f4 f4 00 00
  0x10002aacd320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==31899==ABORTING


Generated at Thu Feb 08 04:05:44 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.