Project: fribidi (fribidi/fribidi), language: c++
Vulnerability instance: fribidi.cve-2022-25310
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: Red Hat Bugzilla
## URL: https://bugzilla.redhat.com/show_bug.cgi?id=2047923
## Description:
Bugzilla ID: 2047923
Title: CVE-2022-25310 fribidi: SEGV in fribidi_remove_bidi_marks

Description
Pedro Sampaio 2022-01-28 21:05:36 UTC
SEGV found in fribidi_remove_bidi_marks.

References:

https://github.com/fribidi/fribidi/issues/183


Comments:
Comment 6
TEJ RATHI 2022-03-23 06:13:23 UTC
Created fribidi tracking bugs for this issue:

Affects: fedora-all [bug 2067045]


Created mingw-fribidi tracking bugs for this issue:

Affects: fedora-all [bug 2067046]

---

Comment 7
TEJ RATHI 2022-05-10 08:10:20 UTC
*** Bug 2047898 has been marked as a duplicate of this bug. ***

---

Comment 8
errata-xmlrpc 2022-11-08 09:22:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7514 https://access.redhat.com/errata/RHSA-2022:7514

---

Comment 9
errata-xmlrpc 2022-11-15 09:57:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:8011 https://access.redhat.com/errata/RHSA-2022:8011

---

Comment 10
Product Security DevOps Team 2022-12-04 17:03:23 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-25310

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/fribidi/fribidi/issues/183
## Description:
Issue: fribidi/fribidi#183
Title: SEGV on unknown address 0x000000000000 (pc 0x55cc8b6086a6 bp 0x7ffed6538790 sp 0x7ffed6538740 T0)
State: closed
Created by: p870613
Created at: 2021-12-22 09:10:25+00:00

Issue Body:
Hi, I found a bug, SEGV.

- SUMMARY: 
   SUMMARY: AddressSanitizer: SEGV (/home/lin/fribidi/bin/fribidi+0x66a5) in fribidi_remove_bidi_marks

- Version
```
➜  bin git:(master) ✗ ./fribidi --version
fribidi (GNU FriBidi) 1.0.11
interface version 4,
Unicode Character Database version 14.0.0,
Configure options.

Copyright (C) 2004  Sharif FarsiWeb, Inc.
Copyright (C) 2001, 2002, 2004, 2005  Behdad Esfahbod
Copyright (C) 1999, 2000, 2017, 2018, 2019  Dov Grobgeld
GNU FriBidi comes with NO WARRANTY, to the extent permitted by law.
You may redistribute copies of GNU FriBidi under
the terms of the GNU Lesser General Public License.
For more information about these matters, see the file named COPYING.

Written by Behdad Esfahbod and Dov Grobgeld
```
At branch 859aa1b

- Steps to reproduce
```
git clone https://github.com/fribidi/fribidi.git
cd fribidi
./autogen.sh
CFLAGS=-fsanitize=address ./configure --disable-shared
make
./bin/fribidi --test  --novisual --basedir ./poc
```


- Platform
```
➜  bin git:(master) ✗ gcc --version
gcc (Ubuntu 7.5.0-3ubuntu1~18.04) 7.5.0
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

➜  bin git:(master) ✗  uname -r
5.4.0-91-generic
➜  bin git:(master) ✗ lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic
```
- ASAN
```
➜  fribidi git:(master) ✗ ./bin/fribidi --test  --novisual --basedir ~/id:000194,sig:06,src:001474,op:arg1,rep:4 
ASAN:DEADLYSIGNAL
=================================================================
==10834==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x55cc8b6086a6 bp 0x7ffed6538790 sp 0x7ffed6538740 T0)
==10834==The signal is caused by a READ memory access.
==10834==Hint: address points to the zero page.
    #0 0x55cc8b6086a5 in fribidi_remove_bidi_marks (/home/lin/fribidi/bin/fribidi+0x66a5)
    #1 0x55cc8b607d17 in main (/home/lin/fribidi/bin/fribidi+0x5d17)
    #2 0x7f41e828cbf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #3 0x55cc8b606d29 in _start (/home/lin/fribidi/bin/fribidi+0x4d29)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/lin/fribidi/bin/fribidi+0x66a5) in fribidi_remove_bidi_marks
==10834==ABORTING

```

poc: [poc.zip](https://github.com/fribidi/fribidi/files/7761436/poc.zip)

Thanks !!!


Comments:
Comment by carnil on 2022-03-25 05:11:17+00:00:
CVE-2022-25310 seems to have been assigned for this issue.

Attachments:
https://github.com/fribidi/fribidi/files/7761436/poc.zip

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p $build
meson --default-library=static --wrap-mode=nodownload -Ddocs=false \
      -Dfuzzer_ldflags="$(echo $LIB_FUZZING_ENGINE)" \
      $build \
  || (cat build/meson-logs/meson-log.txt && false)
ninja -v -j$(nproc) -C $build bin/fribidi-fuzzer

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y python3-pip pkg-config && pip3 install meson==0.53.0 ninja
RUN git clone https://github.com/fribidi/fribidi fribidi
RUN git -C fribidi checkout 62bbf0d2ec5d94b7197f692733c43a115dcc89ba
WORKDIR $SRC/fribidi
COPY build.sh $SRC/

Additional files: