CVE-2017-9761: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The find_eoq function in libr/core/cmd.c in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2017-06-19T16:29Z
Repository: https://github.com/radare/radare2
Language: C
Files changed: libr/core/cmd.c, libr/core/cmd_info.c
Commit date: 2017-06-12 15:50:52 +0200
Commit message: Fix #7727 - undefined pointers and out of band string access fixes

Diff: diff --git a/libr/core/cmd.c b/libr/core/cmd.c
index 96b40a2c860..2875608c3cf 100644
--- a/libr/core/cmd.c
+++ b/libr/core/cmd.c
@@ -1441,11 +1441,11 @@ static int r_core_cmd_subst_i(RCore *core, char *cmd, char *colon) {
 			char *line, *p;
 			haveQuote = *cmd == '"';
 			if (haveQuote) {
 			//	*cmd = 0;
 				cmd++;
-				p = find_eoq (cmd + 1);
+				p = cmd[0] ? find_eoq (cmd + 1) : NULL;
 				if (!p || !*p) {
 					eprintf ("Missing \" in (%s).", cmd);
 					return false;
 				}
 				*p++ = 0;
diff --git a/libr/core/cmd_info.c b/libr/core/cmd_info.c
index 81983d40605..a228e4a775a 100644
--- a/libr/core/cmd_info.c
+++ b/libr/core/cmd_info.c
@@ -393,11 +393,16 @@ static int cmd_info(void *data, const char *input) {
 			if (input[1] == 'H') { // "iHH"
 				RBININFO ("header", R_CORE_BIN_ACC_HEADER, NULL, -1);
 				break;
 			}
 		case 'h': RBININFO ("fields", R_CORE_BIN_ACC_FIELDS, NULL, 0); break;
-		case 'l': RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); break;
+		case 'l': 
+			  {
+				  RBinObject *obj = r_bin_cur_object (core->bin);
+				  RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); 
+			  }
+			  break;
 		case 'L':
 		{
 			char *ptr = strchr (input, ' ');
 			int json = input[1] == 'j'? 'j': 0;
 
@@ -442,11 +447,16 @@ static int cmd_info(void *data, const char *input) {
 			}
 			RBININFO ("resources", R_CORE_BIN_ACC_RESOURCES, NULL, 0); 
 			break;
 		case 'r': RBININFO ("relocs", R_CORE_BIN_ACC_RELOCS, NULL, 0); break;
 		case 'd': RBININFO ("dwarf", R_CORE_BIN_ACC_DWARF, NULL, -1); break;
-		case 'i': RBININFO ("imports",R_CORE_BIN_ACC_IMPORTS, NULL, obj? r_list_length (obj->imports): 0); break;
+		case 'i': {
+				  RBinObject *obj = r_bin_cur_object (core->bin);
+				  RBININFO ("imports", R_CORE_BIN_ACC_IMPORTS, NULL,
+						  obj? r_list_length (obj->imports): 0);
+			  }
+			  break;
 		case 'I': RBININFO ("info", R_CORE_BIN_ACC_INFO, NULL, 0); break;
 		case 'e': RBININFO ("entries", R_CORE_BIN_ACC_ENTRIES, NULL, 0); break;
 		case 'M': RBININFO ("main", R_CORE_BIN_ACC_MAIN, NULL, 0); break;
 		case 'm': RBININFO ("memory", R_CORE_BIN_ACC_MEM, NULL, 0); break;
 		case 'V': RBININFO ("versioninfo", R_CORE_BIN_ACC_VERSIONINFO, NULL, 0); break;

Vulnerable code: 				p = find_eoq (cmd + 1);
		case 'l': RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); break;
		case 'i': RBININFO ("imports",R_CORE_BIN_ACC_IMPORTS, NULL, obj? r_list_length (obj->imports): 0); break;
Fixed code: 				p = cmd[0] ? find_eoq (cmd + 1) : NULL;
		case 'l': 
			  {
				  RBinObject *obj = r_bin_cur_object (core->bin);
				  RBININFO ("libs", R_CORE_BIN_ACC_LIBS, NULL, obj? r_list_length (obj->libs): 0); 
			  }
			  break;
		case 'i': {
				  RBinObject *obj = r_bin_cur_object (core->bin);
				  RBININFO ("imports", R_CORE_BIN_ACC_IMPORTS, NULL,
						  obj? r_list_length (obj->imports): 0);
			  }
			  break;