Project: libplist (libimobiledevice/libplist), language: c++
Vulnerability instance: libplist.cve-2017-6438
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/libimobiledevice/libplist/issues/98
## Description:
Issue: libimobiledevice/libplist#98
Title: heap-buffer-overflow in parse_unicode_node
State: closed
Created by: zhunki
Created at: 2017-02-24 08:24:43+00:00

Issue Body:
```
==8367== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb5e00750 at pc 0x8066423 bp 0xbf8e7e78 sp 0xbf8e7e6c
WRITE of size 2 at 0xb5e00750 thread T0
    #0 0x8066422 in parse_unicode_node /home/b/asan/libplist/src/bplist.c:384
    #1 0x8066422 in parse_bin_node /home/b/asan/libplist/src/bplist.c:679
    #2 0x8066422 in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:759
    #3 0x8063780 in parse_dict_node /home/b/asan/libplist/src/bplist.c:461
    #4 0x8063780 in parse_bin_node /home/b/asan/libplist/src/bplist.c:701
    #5 0x8063780 in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:759
    #6 0x8069760 in plist_from_bin /home/b/asan/libplist/src/bplist.c:853
    #7 0x804a324 in main /home/b/asan/libplist/tools/plistutil.c:150
    #8 0xb5f45a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)
    #9 0x804af35 in _start (/home/b/asan/libplist/tools/plistutil+0x804af35)
0xb5e00751 is located 0 bytes to the right of 1-byte region [0xb5e00750,0xb5e00751)
allocated by thread T0 here:
    #0 0xb610d854 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16854)
    #1 0x8062cbe in parse_unicode_node /home/b/asan/libplist/src/bplist.c:377
    #2 0x8062cbe in parse_bin_node /home/b/asan/libplist/src/bplist.c:679
    #3 0x8062cbe in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:759
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/b/asan/libplist/src/bplist.c:384 parse_unicode_node
Shadow bytes around the buggy address:
  0x36bc0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc00c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc00d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x36bc00e0: fa fa fa fa fa fa fa fa fa fa[01]fa fa fa 00 04
  0x36bc00f0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04
  0x36bc0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36bc0130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==8367== ABORTING
```
[poc.txt](https://github.com/libimobiledevice/libplist/files/798679/poc.txt)



Comments:
Comment by carnil on 2017-03-16 06:13:59+00:00:
This is CVE-2017-6438

---

Comment by nikias on 2017-03-26 18:13:02+00:00:
Should be fixed with https://github.com/libimobiledevice/libplist/commit/dccd9290745345896e3a4a73154576a599fd8b7b

Attachments:
https://github.com/libimobiledevice/libplist/files/798679/poc.txt

Commit References:
dccd9290745345896e3a4a73154576a599fd8b7b

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./autogen.sh --without-cython --enable-debug --without-tests
make -j$(nproc) clean
make -j$(nproc) all

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config
RUN git clone https://github.com/libimobiledevice/libplist libplist
RUN git -C libplist checkout 27ed36c03297713d2cfa79431cdc8105602e80c2
WORKDIR $SRC/libplist
COPY build.sh $SRC/

Additional files: