Project: uriparser (uriparser/uriparser), language: c++
Vulnerability instance: uriparser.cve-2021-46141
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/uriparser/uriparser/issues/121
## Description:
Issue: uriparser/uriparser#121
Title: [CVE-2021-46141] .hostText memory is not properly duped/freed in uriNormalizeSyntax*, uriMakeOwner*, uriFreeUriMembers* for some URIs
State: closed
Created by: autofuzzoss
Created at: 2021-09-29 06:35:00+00:00
Labels: bug, security

Issue Body:
A bug was found within the uriparser. Though it might not be an intended use of the relevant API, the bug can still produce critical issues within a program using uriparser. It would be best if the affected logic is checked beforehand. 
The bug was found with a fuzzer based on the test-code"TestNormalizeSyntaxMaskRequired" 

_*crash log*
```
==2151==ERROR: AddressSanitizer: SEGV on unknown address 0x0000004d9be0 (pc 0x00000041ca94 bp 0x000000000000 sp 0x7fff34437d00 T0)
==2151==The signal is caused by a WRITE memory access.
    #0 0x41ca94 in __asan::Allocator::Deallocate(void*, unsigned long, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType)
    #1 0x493d41 in free 
    #2 0x4c6892 in (anonymous namespace)::countingFree(UriMemoryManagerStruct*, void*)
    #3 0x7fca1c05a4b2 in uriNormalizeSyntaxExMmA_ 
```

Steps to reproduce:
1. git clone https://github.com/uriparser/uriparser.git
2. cd uriparser & mkdir build & cd build
3. Build
   cmake -DCMAKE_BUILD_TYPE=Release -DURIPARSER_BUILD_DOCS:BOOL=OFF -DBUILD_SHARED_LIBS:BOOL=ON ..
   make -j8
4. Download the attached file(1.cpp)
5. Build TEST CODE (1.cpp)
   clang++ -g -fsanitize=address,fuzzer-no-link -o 1 1.cpp -I uriparser/include/  -Luriparser/build -luriparser
6. Run
   LD_LIBRARY_PATH=uriparser/build/ ./1
   
OS:ubuntu 18.04
[uriparser_poc1.tar.gz](https://github.com/uriparser/uriparser/files/7249388/uriparser_poc1.tar.gz)




Comments:
Comment by hartwork on 2021-09-29 12:26:26+00:00:
@afosscontact thanks for the detailed report, I will have a closer look.

---

Comment by hartwork on 2021-10-15 20:41:00+00:00:
@afosscontact confirming as a bug, fixed by pull request #124 (along with issue #122). Thanks for the report again! :pray: 

---

Comment by autofuzzoss on 2021-10-17 23:15:18+00:00:
Thank you for the fix
Is it possible to issue CVE ID?
If you are not possible, should you ask MITRE?

---

Comment by hartwork on 2021-10-18 10:06:23+00:00:
Related: https://github.com/uriparser/uriparser/issues/122#issuecomment-945610649

---

Comment by hartwork on 2021-12-17 22:01:23+00:00:
@junsik-kim0 I'm in the process of making a new release (see #128 and #129). Regarding the two issues you reported, my best knowledge so far is that they can be can cause denial of service. Are you aware of any other potential impact? Also, have you decided if you want to share your name with me and/or Mitre for the CVE finding credits? A soon reply would be great, and I would then request two CVEs, ideally before making the release. Thanks in advance! :pray: 


---

Comment by autofuzzoss on 2021-12-20 07:51:19+00:00:
Hello, I agree to share a name
My name is "Autofuzz"
Because I am getting CVE in the name AutoFuzz.
If the CVE number is issued, please let me know.
If you have any information you need, please let me know.
Thanks in advance!  :)

---

Comment by hartwork on 2021-12-20 15:31:35+00:00:
> Hello, I agree to share a name My name is "Autofuzz" Because I am getting CVE in the name AutoFuzz.

I had a real name in mind, but okay, I can put "Autofuzz" in the Mitre form for discovery credits.


> If the CVE number is issued, please let me know. If you have any information you need, please let me know. Thanks in advance! :)

I'm still in the dark about the worst that could be done with an exploit on #121 and #122. Anything beyond a crash-caused denial-of-service? Are you aware of anything more? [CWE-590: Free of Memory not on the Heap](https://cwe.mitre.org/data/definitions/590.html) mentions "*potential* for arbitrary code execution" (emphasis mine) but I'm unsure if that's realistic for our case here. There is mention of "undefined behavior" elsewhere.



---

Comment by autofuzzoss on 2021-12-21 23:58:14+00:00:
I can not be sure that this remort exploit(potential for arbitrary code execution) is possible
But this is a potential danger that is a matter of memory logic, and many applications that use libraries can cause denial of service.
I can not know the Public API of Uriparser, I can not know how dangerous this is.
thank you

---

Comment by autofuzzoss on 2022-01-06 00:12:19+00:00:
Is CVE ID Issuance Are Is Isuable?
I would appreciate if you share your progress.

---

Comment by hartwork on 2022-01-06 00:42:53+00:00:
Hi @junsik-kim0, I requested two CVEs from Mitre about four hours ago today at https://cveform.mitre.org/ . With some luck I hear back tomorrow.

---

Comment by hartwork on 2022-01-06 15:33:24+00:00:
@junsik-kim0 I have received two CVEs now:
- [CVE-2021-46141](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46141) for #121
- [CVE-2021-46142](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46142) for #122

I would like to thank you again for your whitehat security work on uriparser :pray: 

Attachments:
https://github.com/uriparser/uriparser/files/7249388/uriparser_poc1.tar.gz

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DCMAKE_BUILD_TYPE=Release -DURIPARSER_BUILD_DOCS:BOOL=OFF -DBUILD_SHARED_LIBS:BOOL=OFF -DURIPARSER_BUILD_TESTS:BOOL=OFF ..
make -j$(nproc)
make install -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake wget sudo libtool cmake
RUN git clone https://github.com/uriparser/uriparser uriparser
RUN git -C uriparser checkout d8722e7be3eff3593819f9980ed1837c00da3bc1
WORKDIR $SRC/uriparser
COPY build.sh $SRC/

Additional files:
filename: uri_dissect_query_malloc_fuzzer.cc
content: // Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Fuzz UriQuery.c:
//   uriDissectQueryMallocA
//   uriComposeQueryA

#include <cstddef>
#include <cstdint>
#include <string>
#include <utility>
#include <vector>

using std::string;
#include "uriparser/include/uriparser/Uri.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

  const string query(reinterpret_cast<const char *>(data), size);

  UriQueryListA *query_list = nullptr;
  int item_count = -1;

  const char *query_start = query.c_str();
  const char *query_end = query_start + size;

  // Break a query like "a=b&2=3" into key/value pairs.
  int result =
      uriDissectQueryMallocA(&query_list, &item_count, query_start, query_end);

  if (query_list == nullptr || result != URI_SUCCESS || item_count < 0)
    return 0;

  int chars_required = 0;
  if (uriComposeQueryCharsRequiredA(query_list, &chars_required) != URI_SUCCESS)
    return 0;

  if (!chars_required) {
    uriFreeQueryListA(query_list);
    return 0;
  }

  std::vector<char> buf(chars_required, 0);
  int written = -1;
  // Reverse the process of uriDissectQueryMallocA.
  result = uriComposeQueryA(buf.data(), query_list, chars_required, &written);

  uriFreeQueryListA(query_list);
  return 0;
}

filename: uri_free_fuzzer.cc
content: // Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <cstddef>
#include <cstdint>
#include <string>

#include "uriparser/include/uriparser/Uri.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  std::basic_string<char> fuzz_uri(reinterpret_cast<const char *>(data), size);
  UriParserStateA state;
  UriUriA uriA;
  state.uri = &uriA;
  uriParseUriA(&state, fuzz_uri.c_str());
  uriFreeUriMembersA(&uriA);
  return 0;
}

filename: uri_parse_fuzzer.cc
content: // Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <cstddef>
#include <cstring>
#include <string>
#include <vector>
#include <fuzzer/FuzzedDataProvider.h>

using std::string;
#include "uriparser/include/uriparser/Uri.h"
#include "uriparser/include/uriparser/UriIp4.h"

class UriParserA {
 public:
  UriParserA() { memset((void *)&uri_, 0, sizeof(uri_)); }
  ~UriParserA() { uriFreeUriMembersA(&uri_); }

  UriUriA *get_mutable_uri() { return &uri_; }
  UriUriA *get_uri() const { return const_cast<UriUriA *>(&uri_); }

 private:
  UriUriA uri_;
};

void Escapes(const string &uri) {
  const char *first = uri.c_str();
  // A new line char takes 6 char to encode.
  // Use a vector to make a C string.
  std::vector<char> buf1(uri.size() * 6 + 1);
  std::vector<char> buf2(uri.size() * 3 + 1);

  char *result;
  result = uriEscapeA(first, &buf1[0], URI_TRUE, URI_TRUE);
  result = uriEscapeA(first, &buf1[0], URI_FALSE, URI_TRUE);
  if (buf1.data()) uriUnescapeInPlaceA(&buf1[0]);

  result = uriEscapeA(first, &buf2[0], URI_TRUE, URI_FALSE);
  result = uriEscapeA(first, &buf2[0], URI_FALSE, URI_FALSE);
  if (buf2.data()) uriUnescapeInPlaceA(&buf2[0]);
}

void FileNames(const string &uri) {
  const size_t size = 8 + 3 * uri.size() + 1;
  std::vector<char> buf(size);

  uriUnixFilenameToUriStringA(uri.c_str(), &buf[0]);
  uriWindowsFilenameToUriStringA(uri.c_str(), &buf[0]);
  uriUriStringToUnixFilenameA(uri.c_str(), &buf[0]);
  uriUriStringToWindowsFilenameA(uri.c_str(), &buf[0]);
}

int uriParseIpFourAddressA(unsigned char *octetOutput, const char *first,
                           const char *afterLast);

void Ipv4(const string &s) {
  const char *cstr = s.c_str();
  unsigned char result[4] = {};
  uriParseIpFourAddressA(result, cstr, &cstr[s.size()]);
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

  FuzzedDataProvider stream(data, size);
  bool domainRelative = stream.ConsumeBool();
  size_t uriSize = stream.remaining_bytes() / 2;

  const string uri1 = stream.ConsumeBytesAsString(uriSize);
  const string uri2 = stream.ConsumeRemainingBytesAsString();

  Escapes(uri1);
  Escapes(uri2);

  FileNames(uri1);
  FileNames(uri2);

  Ipv4(uri1);
  Ipv4(uri2);

  UriParserA parser1;
  UriParserStateA state1;
  state1.uri = parser1.get_mutable_uri();
  if (uriParseUriA(&state1, uri1.c_str()) != URI_SUCCESS)
    return 0;

  char buf[1024 * 8] = {0};
  int written = 0;
  uriToStringA(buf, state1.uri, sizeof(buf), &written);

  UriParserA parser2;
  UriParserStateA state2;
  state2.uri = parser2.get_mutable_uri();
  if (uriParseUriA(&state2, uri2.c_str()) != URI_SUCCESS)
    return 0;

  uriEqualsUriA(state1.uri, state2.uri);

  uriNormalizeSyntaxA(state1.uri);

  UriUriA absUri;
  uriAddBaseUriA(&absUri, state1.uri, state2.uri);
  uriFreeUriMembersA(&absUri);

  UriUriA relUri;
  uriRemoveBaseUriA(&relUri, state1.uri, state2.uri, domainRelative);
  uriFreeUriMembersA(&relUri);

  return 0;
}