Project: libarchive (libarchive/libarchive), language: c++
Vulnerability instance: libarchive.cve-2017-14501
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/libarchive/libarchive/issues/949
## Description:
Issue: libarchive/libarchive#949
Title: out-of-bounds read in archive_read_format_iso9660_read_header()
State: closed
Created by: carnil
Created at: 2017-09-16 19:13:48+00:00

Issue Body:
Hi

The following was reported downstream in Debian in https://bugs.debian.org/875966

The reproducer (compressed with gzip), base64 `oob.iso.gz` is
````
H4sIAAAAAAACA+3WsQmAQAwF0NwqTvCtHED3X0mbaxQEwUa897o0v0lCkgAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAbd2SudXbnOqWS33nSeZ0Stcr/rBwBnlwBV+x9/sPAIzDOw4AAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJAVTyAwTg/wAA

````
tested against 5562545b5562f6d12a4ef991fae158bf4ccf92b6
````
ASAN_OPTIONS="detect_leaks=0" ./bsdtar -xOf ~/oob.iso
=================================================================
==13912==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x631000024800 at pc 0x5644c43511e9 bp 0x7ffc1fbd20d0 sp 0x7ffc1fbd20c8
READ of size 1 at 0x631000024800 thread T0
    #0 0x5644c43511e8 in parse_file_info libarchive/archive_read_support_format_iso9660.c:1767
    #1 0x5644c434c76f in choose_volume libarchive/archive_read_support_format_iso9660.c:1115
    #2 0x5644c434cdeb in archive_read_format_iso9660_read_header libarchive/archive_read_support_format_iso9660.c:1181
    #3 0x5644c4304d61 in _archive_read_next_header2 libarchive/archive_read.c:648
    #4 0x5644c430502f in _archive_read_next_header libarchive/archive_read.c:686
    #5 0x5644c43c938f in archive_read_next_header libarchive/archive_virtual.c:148
    #6 0x5644c42e0110 in read_archive tar/read.c:260
    #7 0x5644c42df303 in tar_mode_x tar/read.c:112
    #8 0x5644c42dc62d in main tar/bsdtar.c:866
    #9 0x7f31071db2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #10 0x5644c42d7f79 in _start (/root/libarchive/bsdtar+0x3ff79)

0x631000024800 is located 0 bytes to the right of 65536-byte region [0x631000014800,0x631000024800)
allocated by thread T0 here:
    #0 0x7f3108af8b70 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9b70)
    #1 0x5644c431926e in file_open libarchive/archive_read_open_filename.c:358
    #2 0x5644c4303da8 in archive_read_open1 libarchive/archive_read.c:480
    #3 0x5644c43186ba in archive_read_open_filenames libarchive/archive_read_open_filename.c:152
    #4 0x5644c43182ae in archive_read_open_filename libarchive/archive_read_open_filename.c:109
    #5 0x5644c42dfed2 in read_archive tar/read.c:222
    #6 0x5644c42df303 in tar_mode_x tar/read.c:112
    #7 0x5644c42dc62d in main tar/bsdtar.c:866
    #8 0x7f31071db2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)

SUMMARY: AddressSanitizer: heap-buffer-overflow libarchive/archive_read_support_format_iso9660.c:1767 in parse_file_info
Shadow bytes around the buggy address:
  0x0c627fffc8b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffc8c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffc8d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffc8e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c627fffc8f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c627fffc900:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffc910: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffc920: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffc930: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffc940: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c627fffc950: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==13912==ABORTING
````


Comments:
Comment by carnil on 2017-09-17 18:28:47+00:00:
This issue was assigned CVE-2017-14501

---

Comment by VictorRodriguez on 2017-11-23 16:30:00+00:00:
Hi, is there any effort to fix this? How critical is for you this issue ? 

---

Comment by carnil on 2017-12-14 09:21:27+00:00:
Hi

On Wed, Dec 13, 2017 at 08:42:11AM -0800, Leonardo Sandoval wrote:
> Hi @carnil, is someone between the community is planning to fix this
> issue?

Honestly, I do not know if someone is working on it. We are not
actively on Debian's side (yet), just reported the issue to "upstream"
as it was first reported in Debian bug https://bugs.debian.org/875966

Defitnively wuld be interested if we could apply a fix downstream in
Debian.


---

Comment by cemeyer on 2018-08-02 16:28:53+00:00:
Per MITRE,

> CVSS v3.0 Severity and Metrics:
> Base Score: 6.5 MEDIUM 
> Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (V3 legend) 
> Impact Score: 3.6 
> Exploitability Score: 2.8

---

Comment by RajeshMalla on 2022-11-25 06:18:02+00:00:
can anybody tell me whether this is fixed in 3.3.3-1.el8 libarchive or not.

Commit References:
5562545b5562f6d12a4ef991fae158bf4ccf92b6

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./configure
make -j$(nproc) all

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config libbz2-dev liblzo2-dev liblzma-dev liblz4-dev libz-dev libxml2-dev libssl-dev libacl1-dev libattr1-dev
RUN git clone https://github.com/libarchive/libarchive libarchive
RUN git -C libarchive checkout 98a695399e8e7420635a5448aecde8b0a82fb83a
WORKDIR $SRC/libarchive
COPY build.sh $SRC/

Additional files:
filename: libarchive_fuzzer.cc
content: // Copyright 2016 Google Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
////////////////////////////////////////////////////////////////////////////////
#include <stddef.h>
#include <stdint.h>
#include <vector>

#include "archive.h"

struct Buffer {
  const uint8_t *buf;
  size_t len;
};

ssize_t reader_callback(struct archive *a, void *client_data,
                        const void **block) {
  Buffer *buffer = reinterpret_cast<Buffer *>(client_data);
  *block = buffer->buf;
  ssize_t len = buffer->len;
  buffer->len = 0;
  return len;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *buf, size_t len) {
  ssize_t r;
  struct archive *a = archive_read_new();

  archive_read_support_filter_all(a);
  archive_read_support_format_all(a);

  Buffer buffer = {buf, len};
  archive_read_open(a, &buffer, NULL, reader_callback, NULL);

  std::vector<uint8_t> data_buffer(getpagesize(), 0);
  struct archive_entry *entry;
  while (archive_read_next_header(a, &entry) == ARCHIVE_OK) {
    while ((r = archive_read_data(a, data_buffer.data(),
            data_buffer.size())) > 0)
      ;
    if (r == ARCHIVE_FATAL)
      break;
  }

  archive_read_free(a);
  return 0;
}