Project: yara (virustotal/yara), language: c++
Vulnerability instance: yara.cve-2017-8929
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/VirusTotal/yara/issues/658
## Description:
Issue: VirusTotal/yara#658
Title: Use-after-free in sized_string_cmp()
State: closed
Created by: fumfel
Created at: 2017-05-12 06:39:04+00:00

Issue Body:
**Use-after-free in sized_string_cmp()**

Git HEAD: eef165b9a434e2292df3d2a2a83d3d44e9d14091

[Payload](https://github.com/VirusTotal/yara/files/995237/yara_uaf_sized_string_cmp.txt)

To reproduce: `yara yara_uaf_sized_string_cmp.yar strings`

ASAN:
```
==18452==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000450 at pc 0x0000005ac75e bp 0x7fff366d71b0 sp 0x7fff366d71a8
READ of size 4 at 0x604000000450 thread T0
    #0 0x5ac75d in sized_string_cmp XYZ/yara/libyara/sizedstr.c:39:14
    #1 0x58cca4 in yr_execute_code XYZ/yara/libyara/exec.c:1096:21
    #2 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #3 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #4 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #5 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #6 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #7 0x41a7d8 in _start (/usr/local/bin/yara+0x41a7d8)

0x604000000450 is located 0 bytes inside of 44-byte region [0x604000000450,0x60400000047c)
freed by thread T0 here:
    #0 0x4c23c2 in __interceptor_free (/usr/local/bin/yara+0x4c23c2)
    #1 0x514c93 in yr_object_set_string XYZ/yara/libyara/object.c:1048:5
    #2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
    #3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
    #4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #7 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x4c26f3 in malloc (/usr/local/bin/yara+0x4c26f3)
    #1 0x514cab in yr_object_set_string XYZ/yara/libyara/object.c:1052:41
    #2 0x56bd9d in data_md5 XYZ/yara/libyara/modules/hash.c
    #3 0x593434 in yr_execute_code XYZ/yara/libyara/exec.c:572:22
    #4 0x536784 in yr_rules_scan_mem_blocks XYZ/yara/libyara/rules.c:472:3
    #5 0x537b80 in yr_rules_scan_mem XYZ/yara/libyara/rules.c:586:10
    #6 0x537b80 in yr_rules_scan_file XYZ/yara/libyara/rules.c:610
    #7 0x4f6084 in main XYZ/yara/yara.c:1229:14
    #8 0x7f0ac130e82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free XYZ/yara/libyara/sizedstr.c:39:14 in sized_string_cmp
Shadow bytes around the buggy address:
  0x0c087fff8030: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c087fff8040: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c087fff8050: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8060: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff8070: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 01 fa
=>0x0c087fff8080: fa fa 00 00 00 00 00 fa fa fa[fd]fd fd fd fd fd
  0x0c087fff8090: fa fa 00 00 00 00 00 04 fa fa fa fa fa fa fa fa
  0x0c087fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff80d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==18452==ABORTING

```




Attachments:
https://github.com/VirusTotal/yara/files/995237/yara_uaf_sized_string_cmp.txt

Commit References:
eef165b9a434e2292df3d2a2a83d3d44e9d14091

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap.sh
./configure --enable-macho --enable-debug --enable-dex --enable-dotnet --without-crypto
make clean -j$(nproc)
make -j$(nproc) all
make install -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y automake autoconf make libtool pkg-config bison flex
RUN git clone https://github.com/virustotal/yara yara
RUN git -C yara checkout c2ed7a46618f93a0dfe011dc608f2b604f365251
WORKDIR $SRC/yara
COPY build.sh $SRC/

Additional files: