CVE-2022-1207: Out-of-bounds Read (CWE-125)
value: Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.6
Published: 2022-04-01T19:15Z
Repository: https://github.com/radareorg/radare2
Language: C
Files changed: libr/anal/p/anal_cris.c
Commit date: 2022-04-01 21:03:24 +0200
Commit message: Fix 1 byte oobread in the cris analysis plugin ##crash

Diff: diff --git a/libr/anal/p/anal_cris.c b/libr/anal/p/anal_cris.c
index 2b95c37e04f..db30421edd2 100644
--- a/libr/anal/p/anal_cris.c
+++ b/libr/anal/p/anal_cris.c
@@ -1,14 +1,17 @@
-/* radare2 - LGPL - Copyright 2014-2015 - pancake */
+/* radare2 - LGPL - Copyright 2014-2022 - pancake */
 
 #include <r_asm.h>
 #include <r_lib.h>
 
 static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAnalOpMask mask) {
 	int opsize = -1;
 	op->type = -1;
 	opsize = 2;
+	if (len < 1) {
+		return -1;
+	}
 	switch (buf[0]) {
 	case 0x3f:
 	case 0x4f:
 		op->type = R_ANAL_OP_TYPE_MOV;
 		opsize = 4;
@@ -19,13 +22,13 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
 		break;
 	case 0x7f:
 		op->type = R_ANAL_OP_TYPE_LEA;
 		if (len > 5) {
 			op->ptr = buf[2];
-			op->ptr |= buf[3]<<8;
-			op->ptr |= buf[4]<<16;
-			op->ptr |= ((ut32)(0xff&buf[5]))<<24;
+			op->ptr |= buf[3] << 8;
+			op->ptr |= buf[4] << 16;
+			op->ptr |= ((ut32)(0xff & buf[5])) << 24;
 			op->ptr += addr;
 			opsize = 6;
 		} else {
 			// error
 			op->ptr = UT64_MAX;
@@ -33,21 +36,24 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
 		break;
 	case 0xbf: // bsr
 		op->type = R_ANAL_OP_TYPE_CALL;
 		if (len > 5) {
 			st32 delta = buf[2];
-			delta |= buf[3]<<8;
-			delta |= buf[4]<<16;
-			delta |= buf[5]<<24;
+			delta |= buf[3] << 8;
+			delta |= buf[4] << 16;
+			delta |= buf[5] << 24;
 			op->jump = addr + delta;
 		} else {
 			op->jump = UT64_MAX;
 		}
 		op->fail = addr + 6;
 		opsize = 6;
 		break;
 	case 0x00:
+		if (len < 2) {
+			break;
+		}
 		if (buf[1] == 0x00) {
 			op->type = R_ANAL_OP_TYPE_TRAP;
 		} else {
 			op->type = R_ANAL_OP_TYPE_JMP;
 			{
@@ -55,24 +61,30 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
 				op->jump = addr + delta;
 			}
 		}
 		break;
 	case 0xf0:
-		if (buf[1]==0xb9) {
+		if (len < 2) {
+			break;
+		}
+		if (buf[1] == 0xb9) {
 			op->type = R_ANAL_OP_TYPE_RET;
 		}
 		break;
 	default:
+		if (len < 2) {
+			break;
+		}
 		switch (buf[1]) {
 		case 0x00:
 			op->type = R_ANAL_OP_TYPE_CJMP; // BCC
 			break;
 		case 0xf3:
 			op->type = R_ANAL_OP_TYPE_SHR;
 			break;
 		case 0x96: // move.d r, r
-			if (buf[0] >=0xc0) {
+			if (buf[0] >= 0xc0) {
 				op->type = R_ANAL_OP_TYPE_CMP;
 			} else {
 				op->type = R_ANAL_OP_TYPE_MOV;
 			}
 			break;
@@ -240,10 +252,11 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
 static bool set_reg_profile(RAnal *anal) {
 	const char *p =
 		"=PC	pc\n"
 		"=SP	r14\n" // XXX
 		"=BP	srp\n" // XXX
+		"=SN	r0\n"
 		"=A0	r0\n"
 		"=A1	r1\n"
 		"=A2	r2\n"
 		"=A3	r3\n"
 		"gpr	sp	.32	56	0\n" // r14

Vulnerable code: /* radare2 - LGPL - Copyright 2014-2015 - pancake */
			op->ptr |= buf[3]<<8;
			op->ptr |= buf[4]<<16;
			op->ptr |= ((ut32)(0xff&buf[5]))<<24;
			delta |= buf[3]<<8;
			delta |= buf[4]<<16;
			delta |= buf[5]<<24;
		if (buf[1]==0xb9) {
			if (buf[0] >=0xc0) {
Fixed code: /* radare2 - LGPL - Copyright 2014-2022 - pancake */
	if (len < 1) {
		return -1;
	}
			op->ptr |= buf[3] << 8;
			op->ptr |= buf[4] << 16;
			op->ptr |= ((ut32)(0xff & buf[5])) << 24;
			delta |= buf[3] << 8;
			delta |= buf[4] << 16;
			delta |= buf[5] << 24;
		if (len < 2) {
			break;
		}
		if (len < 2) {
			break;
		}
		if (buf[1] == 0xb9) {
		if (len < 2) {
			break;
		}
			if (buf[0] >= 0xc0) {
		"=SN	r0\n"