Project: opensc (opensc/opensc), language: c++
Vulnerability instance: opensc.cve-2019-6502
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/OpenSC/OpenSC/issues/1586
## Description:
Issue: OpenSC/OpenSC#1586
Title: Memory leak
State: closed
Created by: RootUp
Created at: 2019-01-20 17:08:17+00:00

Issue Body:
Hi Team, 

I have build this  repo using **clang** via ASAN, a **memory leak** was detected in `eidenv.c`

**ASAN**
```c
==32025==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 632 byte(s) in 1 object(s) allocated from:
    #0 0x4d28d8 in calloc (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x4d28d8)
    #1 0x7f0bc7ce69df in sc_context_create /home/input0/Desktop/OpenSC/src/libopensc/ctx.c:809:8
    #2 0x50ca93 in main /home/input0/Desktop/OpenSC/src/tools/eidenv.c:397:6
    #3 0x7f0bc6be6b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

Indirect leak of 224 byte(s) in 1 object(s) allocated from:
    #0 0x4d28d8 in calloc (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x4d28d8)
    #1 0x7f0bc7da7bf0 in pcsc_init /home/input0/Desktop/OpenSC/src/libopensc/reader-pcsc.c:763:10
    #2 0x50ca93 in main /home/input0/Desktop/OpenSC/src/tools/eidenv.c:397:6
    #3 0x7f0bc6be6b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

Indirect leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x4d26d0 in __interceptor_malloc (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x4d26d0)
    #1 0x7f0bc813fd39 in list_init /home/input0/Desktop/OpenSC/src/common/simclist.c:260:43

Indirect leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x4d26d0 in __interceptor_malloc (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x4d26d0)
    #1 0x7f0bc813fb1e in list_init /home/input0/Desktop/OpenSC/src/common/simclist.c:244:47

Indirect leak of 24 byte(s) in 1 object(s) allocated from:
    #0 0x4d26d0 in __interceptor_malloc (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x4d26d0)
    #1 0x7f0bc813fafc in list_init /home/input0/Desktop/OpenSC/src/common/simclist.c:243:47

Indirect leak of 7 byte(s) in 1 object(s) allocated from:
    #0 0x471c20 in strdup (/home/input0/Desktop/OpenSC/src/tools/.libs/eidenv+0x471c20)
    #1 0x7f0bc7ce6a69 in sc_context_create /home/input0/Desktop/OpenSC/src/libopensc/ctx.c:818:19
    #2 0x50ca93 in main /home/input0/Desktop/OpenSC/src/tools/eidenv.c:397:6
    #3 0x7f0bc6be6b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: 951 byte(s) leaked in 6 allocation(s).
```

**eidenv.c**
```c
	r = sc_context_create(&ctx, &ctx_param);
	if (r) {
	fprintf(stderr, "Failed to establish context: %s\n",
		sc_strerror(r));
return 1;
```


Comments:
Comment by frankmorgner on 2019-01-21 15:10:10+00:00:
`sc_context_create` should clean up its allocations in case of an error. please check whether you're using an old version. At best, check what the problem is and make a pull request.

---

Comment by RootUp on 2019-01-21 15:15:55+00:00:
Will surely have a look and do a PR, but I have used the latest version in this case. 
`git clone https://github.com/OpenSC/OpenSC`

---

Comment by abergmann on 2019-01-22 11:47:03+00:00:
[CVE-2019-6502](https://nvd.nist.gov/vuln/detail/CVE-2019-6502) was assigned to this issue.

---

Comment by frankmorgner on 2019-02-04 09:53:33+00:00:
@RootUp did you make any progress? There is also this issue #1220, that may be related.

---

Comment by RootUp on 2019-02-10 18:48:07+00:00:
Hi @frankmorgner 
Not yet, but its in my todo list. Thank you.

---

Comment by sgayou on 2019-02-19 15:22:52+00:00:
Hi RootUp. Could you please share how you are triggering/reproducing this leak?

---

Comment by RootUp on 2019-02-19 17:49:45+00:00:
Sure, below steps for your reference.
```bash
git clone https://github.com/OpenSC/OpenSC.git
./bootstrap
CC=afl-clang-fast CXX=afl-clang-fast++ ASAN_OPTIONS=symbolize=0 AFL_USE_ASAN=1 ./configure
make
```

---

Comment by sgayou on 2019-02-21 18:30:28+00:00:
Thanks, that's how to build it, but how do you reliably reproduce the issue?

---

Comment by RootUp on 2019-02-23 19:56:35+00:00:
Hi @sgayou I can reproduce this issue almost every time. 

---

Comment by sgayou on 2019-03-01 19:27:59+00:00:
Thank you for reporting this RootUp.

Please see https://bugzilla.redhat.com/show_bug.cgi?id=1668933 for more information.

Submitted a pull request 1616 to fix this. The first issue appears to be a failure to sc_release_context when a card reader isn't found. Instead of just returning -1, cleanup needs to occur first.

After that fix, the 632/224 byte leaks are gone, but there are still a few smaller leaks. I believe the secondary leaks are from pcsc-lite and not OpenSC. See this issue: https://github.com/OpenSC/OpenSC/issues/512

Overall, I don't think think the first issue is a security issue at all. The second may be, but it would be a potential denial of service in pcsc-lite instead of OpenSC (although it would impact OpenSC as a consumer of the library). Interestingly, pcsc-lite doesn't have a CVE assigned for that flaw, which seems a bit more credible.

I'd recommend the maintainer REJECT this CVE. Let me know if anyone else has a different opinion on the analysis.

---

Comment by sgayou on 2019-03-04 19:38:12+00:00:
> After that fix, the 632/224 byte leaks are gone, but there are still a few smaller leaks. I believe the secondary leaks are from pcsc-lite and not OpenSC. See this issue: #512

I am now unable to reproduce these "secondary leaks" after testing multiple times. Unclear what I was doing yesterday to cause them, but they're gone now. Tested on versions across various RHEL builds as well as Fedora 29.

Patch still seems correct for initial issue.

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap
./configure --disable-optimization --disable-shared --disable-pcsc --enable-ctapi --enable-fuzzing FUZZING_LIBS="$LIB_FUZZING_ENGINE"
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y pcscd libccid libpcsclite-dev libssl-dev libreadline-dev autoconf automake build-essential docbook-xsl xsltproc libtool pkg-config zlib1g-dev
RUN git clone https://github.com/opensc/opensc opensc
RUN git -C opensc checkout f1691fc91fc113191c3a8aaf5facd6983334ec47
WORKDIR $SRC/opensc
COPY build.sh $SRC/

Additional files: