Project: liblouis (liblouis/liblouis), language: c++
Vulnerability instance: liblouis.cve-2018-12085
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/liblouis/liblouis/issues/595
## Description:
Issue: liblouis/liblouis#595
Title: ASan stack-based buffer overflow compileTranslationTable.c in 1130 in parseChars
State: closed
Created by: fgeek
Created at: 2018-06-05 21:09:49+00:00
Labels: memory error

Issue Body:
[4c8ecb4f49e783c3fff70b43869dda30351b5084.zip](https://github.com/liblouis/liblouis/files/2073999/4c8ecb4f49e783c3fff70b43869dda30351b5084.zip)
Tested commit: 15635b4769252c113765c9562c558fef27e4df22
Credit: Henri Salo
Tools: [american fuzzy lop](http://lcamtuf.coredump.cx/afl/) 2.52b, [afl-utils](https://github.com/rc0r/afl-utils)
Thanks to Kapsi internet-käyttäjät ry for providing valuable fuzzing resources.
```
cat 4c8ecb4f49e783c3fff70b43869dda30351b5084|./lou_translate en-us-g2.ctb
<snip>
==29109==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdefd0a862 at pc 0x7fccb369de19 bp 0x7ffdefd08780 sp 0x7ffdefd08778
WRITE of size 2 at 0x7ffdefd0a862 thread T0
    #0 0x7fccb369de18 in parseChars /home/hsalo/src/liblouis/liblouis/compileTranslationTable.c:1130
    #1 0x7fccb36d4260 in _lou_extParseChars /home/hsalo/src/liblouis/liblouis/compileTranslationTable.c:1176
    #2 0x56114ed04f31 in translate_input /home/hsalo/src/liblouis/tools/lou_translate.c:71
    #3 0x56114ed0455d in main /home/hsalo/src/liblouis/tools/lou_translate.c:199
    #4 0x7fccb330c2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
    #5 0x56114ed047d9 in _start (/home/hsalo/builds/liblouis/15635b4769252c113765c9562c558fef27e4df22/bin/lou_translate+0x27d9)

Address 0x7ffdefd0a862 is located in stack of thread T0 at offset 8290 in frame
    #0 0x7fccb36d3ccf in _lou_extParseChars /home/hsalo/src/liblouis/liblouis/compileTranslationTable.c:1168

  This frame has 2 object(s):
    [32, 4130) 'wideIn'
    [4192, 8290) 'result' <== Memory access at offset 8290 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/hsalo/src/liblouis/liblouis/compileTranslationTable.c:1130 in parseChars
Shadow bytes around the buggy address:
  0x10003df994b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df994c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df994d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df994e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df994f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10003df99500: 00 00 00 00 00 00 00 00 00 00 00 00[02]f4 f4 f4
  0x10003df99510: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df99520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df99530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df99540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10003df99550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==29109==ABORTING
```


Attachments:
https://github.com/liblouis/liblouis/files/2073999/4c8ecb4f49e783c3fff70b43869dda30351b5084.zip

Commit References:
15635b4769252c113765c9562c558fef27e4df22
4c8ecb4f49e783c3fff70b43869dda30351b5084

Build script:
#!/bin/bash
# Default build script template for C/C++ projects
set -eu

# Define configuration options
CONFIG_OPTS="--disable-shared"
CMAKE_OPTS="-DCMAKE_BUILD_TYPE=Debug"
MAKE_OPTS="-j$(nproc)"
BUILD_DIR="build"

# 1. Run build preparation scripts if they exist
for prep_script in buildconf autogen.sh bootstrap; do
  if [ -x "$prep_script" ]; then
    echo "Running $prep_script..."
    ./$prep_script
    break
  elif [ -f "$prep_script" ]; then
    echo "Found $prep_script but it's not executable, setting permissions..."
    chmod +x $prep_script
    ./$prep_script
    break
  fi
done

# 2. Handle different build systems
if [ -f "configure" ]; then
  echo "Found configure script, running with options: $CONFIG_OPTS"
  ./configure $CONFIG_OPTS

  echo "Building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "CMakeLists.txt" ]; then
  echo "Found CMakeLists.txt, using CMake build system"
  mkdir -p $BUILD_DIR
  cd $BUILD_DIR
  cmake $CMAKE_OPTS ..
  make $MAKE_OPTS
elif [ -f "Makefile" ] || [ -f "makefile" ]; then
  echo "Found Makefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -f "meson.build" ]; then
  echo "Found meson.build, using Meson build system"
  mkdir -p $BUILD_DIR
  meson setup $BUILD_DIR .
  cd $BUILD_DIR
  ninja
elif [ -f "GNUmakefile" ]; then
  echo "Found GNUmakefile, building with make $MAKE_OPTS"
  make $MAKE_OPTS
elif [ -d ".git" ] && [ -f "Makefile.am" ]; then
  echo "Found Makefile.am, running autoreconf"
  autoreconf -i
  ./configure $CONFIG_OPTS
  make $MAKE_OPTS
else
  echo "WARNING: No recognized build system found!"
  echo "Trying generic approach:"
  
  # Try to detect common source patterns and compile them
  if ls *.c >/dev/null 2>&1 || ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
    echo "Found C/C++ source files, attempting direct compilation"
    if ls *.cpp >/dev/null 2>&1 || ls *.cc >/dev/null 2>&1; then
      CXX=${CXX:-g++}
      echo "Compiling C++ sources with $CXX"
      $CXX -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.cpp *.cc 2>/dev/null || true
    elif ls *.c >/dev/null 2>&1; then
      CC=${CC:-gcc}
      echo "Compiling C sources with $CC"
      $CC -g -O1 -fsanitize=address -fno-omit-frame-pointer -o main *.c 2>/dev/null || true
    fi
  fi
fi

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config zlib1g-dev libpci-dev
RUN git clone https://github.com/liblouis/liblouis liblouis
RUN git -C liblouis checkout 8923b3a3b8beb3021b7076465fcd7145fd9afcda
WORKDIR $SRC/liblouis
COPY build.sh $SRC/

Additional files: