Message287318
OS Version : Ubuntu 16.04 LTS
Python download link : https://www.python.org/ftp/python/3.6.0/Python-3.6.0.tar.xz
Python version : 3.6.0
Normal build cmd :
./configure
make
Asan build cmd:
export CC="/usr/bin/clang -fsanitize=address
export CXX="/usr/bin/clang++ -fsanitize=address
./confiugre
make
GDB:
To enable execution of this file add
add-auto-load-safe-path /home/test/check/PythonGDB/python-gdb.py
line to your configuration file "/home/test/.gdbinit".
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file "/home/test/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual. E.g., run from the shell:
info "(gdb)Auto-loading safe path"
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
PyBytes_FromStringAndSize (str=0xa76000 <error: Cannot access memory at address 0xa76000>, size=1) at Objects/bytesobject.c:108
108 (op = characters[*str & UCHAR_MAX]) != NULL)
Description: Access violation on source operand
Short description: SourceAv (19/22)
Hash: 4b7ecbff5972b39c26f6e0cf37443391.86c50dffa4bdc3a046d693db2d45a01e
Exploitability Classification: UNKNOWN
Explanation: The target crashed on an access violation at an address matching the source operand of the current instruction. This likely indicates a read access violation.
Other tags: AccessViolation (21/22)
ASAN:
=================================================================
==18067==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000e738 at pc 0x00000058bc2b bp 0x7ffe3c2965d0 sp 0x7ffe3c2965c8
READ of size 1 at 0x60200000e738 thread T0
#0 0x58bc2a in PyBytes_FromStringAndSize /home/test/check/PythonASAN/Objects/bytesobject.c:108
#1 0x58bc2a in ?? ??:0
#2 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316
#3 0x5745f0 in ?? ??:0
#4 0x677108 in slot_sq_item /home/test/check/PythonASAN/Objects/typeobject.c:5876
#5 0x677108 in ?? ??:0
#6 0x5d9714 in iter_iternext /home/test/check/PythonASAN/Objects/iterobject.c:63
#7 0x5d9714 in ?? ??:0
#8 0x571fe3 in PyIter_Next /home/test/check/PythonASAN/Objects/abstract.c:3146
#9 0x571fe3 in PySequence_Tuple /home/test/check/PythonASAN/Objects/abstract.c:1797
#10 0x571fe3 in ?? ??:0
#11 0x7ff6988bd4cf in converters_from_argtypes /home/test/check/PythonASAN/Modules/_ctypes/_ctypes.c:2165
#12 0x7ff6988bd4cf in ?? ??:0
#13 0x7ff6988be677 in PyCFuncPtr_set_argtypes /home/test/check/PythonASAN/Modules/_ctypes/_ctypes.c:3036
#14 0x7ff6988be677 in ?? ??:0
#15 0x63b1e7 in _PyObject_GenericSetAttrWithDict /home/test/check/PythonASAN/Objects/object.c:1152
#16 0x63b1e7 in ?? ??:0
#17 0x639d52 in PyObject_SetAttr /home/test/check/PythonASAN/Objects/object.c:932
#18 0x639d52 in ?? ??:0
#19 0x79ad9e in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:2249
#20 0x79ad9e in ?? ??:0
#21 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#22 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870
#23 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905
#24 0x7ab4cb in ?? ??:0
#25 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809
#26 0x7a76f2 in ?? ??:0
#27 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#28 0x7995cc in ?? ??:0
#29 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#30 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#31 0x7a9847 in ?? ??:0
#32 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#33 0x7ac2ea in ?? ??:0
#34 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#35 0x574668 in ?? ??:0
#36 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#37 0x5749fa in ?? ??:0
#38 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#39 0x573e9b in ?? ??:0
#40 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057
#41 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357
#42 0x793369 in ?? ??:0
#43 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#44 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#45 0x7a9847 in ?? ??:0
#46 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#47 0x7ac2ea in ?? ??:0
#48 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#49 0x574668 in ?? ??:0
#50 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#51 0x5749fa in ?? ??:0
#52 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#53 0x573e9b in ?? ??:0
#54 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167
#55 0x66efe4 in ?? ??:0
#56 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316
#57 0x5745f0 in ?? ??:0
#58 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812
#59 0x7a7429 in ?? ??:0
#60 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#61 0x7995cc in ?? ??:0
#62 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#63 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#64 0x7a9847 in ?? ??:0
#65 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#66 0x7ac2ea in ?? ??:0
#67 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#68 0x574668 in ?? ??:0
#69 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#70 0x5749fa in ?? ??:0
#71 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#72 0x573e9b in ?? ??:0
#73 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057
#74 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357
#75 0x793369 in ?? ??:0
#76 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#77 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#78 0x7a9847 in ?? ??:0
#79 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#80 0x7ac2ea in ?? ??:0
#81 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#82 0x574668 in ?? ??:0
#83 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#84 0x5749fa in ?? ??:0
#85 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#86 0x573e9b in ?? ??:0
#87 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167
#88 0x66efe4 in ?? ??:0
#89 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316
#90 0x5745f0 in ?? ??:0
#91 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812
#92 0x7a7429 in ?? ??:0
#93 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#94 0x7995cc in ?? ??:0
#95 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#96 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#97 0x7a9847 in ?? ??:0
#98 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#99 0x7ac2ea in ?? ??:0
#100 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#101 0x574668 in ?? ??:0
#102 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#103 0x5749fa in ?? ??:0
#104 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#105 0x573e9b in ?? ??:0
#106 0x793369 in do_call_core /home/test/check/PythonASAN/Python/ceval.c:5057
#107 0x793369 in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3357
#108 0x793369 in ?? ??:0
#109 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#110 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#111 0x7a9847 in ?? ??:0
#112 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#113 0x7ac2ea in ?? ??:0
#114 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#115 0x574668 in ?? ??:0
#116 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#117 0x5749fa in ?? ??:0
#118 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#119 0x573e9b in ?? ??:0
#120 0x66efe4 in slot_tp_call /home/test/check/PythonASAN/Objects/typeobject.c:6167
#121 0x66efe4 in ?? ??:0
#122 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316
#123 0x5745f0 in ?? ??:0
#124 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812
#125 0x7a7429 in ?? ??:0
#126 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#127 0x7995cc in ?? ??:0
#128 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#129 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870
#130 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905
#131 0x7ab4cb in ?? ??:0
#132 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809
#133 0x7a76f2 in ?? ??:0
#134 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#135 0x7995cc in ?? ??:0
#136 0x7ab4cb in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#137 0x7ab4cb in _PyFunction_FastCall /home/test/check/PythonASAN/Python/ceval.c:4870
#138 0x7ab4cb in fast_function /home/test/check/PythonASAN/Python/ceval.c:4905
#139 0x7ab4cb in ?? ??:0
#140 0x7a76f2 in call_function /home/test/check/PythonASAN/Python/ceval.c:4809
#141 0x7a76f2 in ?? ??:0
#142 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#143 0x7995cc in ?? ??:0
#144 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#145 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#146 0x7a9847 in ?? ??:0
#147 0x7ac2ea in _PyFunction_FastCallDict /home/test/check/PythonASAN/Python/ceval.c:5021
#148 0x7ac2ea in ?? ??:0
#149 0x574668 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2295
#150 0x574668 in ?? ??:0
#151 0x5749fa in _PyObject_Call_Prepend /home/test/check/PythonASAN/Objects/abstract.c:2358
#152 0x5749fa in ?? ??:0
#153 0x573e9b in PyObject_Call /home/test/check/PythonASAN/Objects/abstract.c:2246
#154 0x573e9b in ?? ??:0
#155 0x6713f8 in slot_tp_init /home/test/check/PythonASAN/Objects/typeobject.c:6380
#156 0x6713f8 in ?? ??:0
#157 0x666d8d in type_call /home/test/check/PythonASAN/Objects/typeobject.c:915 (discriminator 1)
#158 0x666d8d in ?? ??:0
#159 0x5745f0 in _PyObject_FastCallDict /home/test/check/PythonASAN/Objects/abstract.c:2316
#160 0x5745f0 in ?? ??:0
#161 0x7a7429 in call_function /home/test/check/PythonASAN/Python/ceval.c:4812
#162 0x7a7429 in ?? ??:0
#163 0x7995cc in _PyEval_EvalFrameDefault /home/test/check/PythonASAN/Python/ceval.c:3275
#164 0x7995cc in ?? ??:0
#165 0x7a9847 in PyEval_EvalFrameEx /home/test/check/PythonASAN/Python/ceval.c:718
#166 0x7a9847 in _PyEval_EvalCodeWithName /home/test/check/PythonASAN/Python/ceval.c:4119
#167 0x7a9847 in ?? ??:0
#168 0x78e0df in PyEval_EvalCodeEx /home/test/check/PythonASAN/Python/ceval.c:4140
#169 0x78e0df in PyEval_EvalCode /home/test/check/PythonASAN/Python/ceval.c:695
#170 0x78e0df in ?? ??:0
#171 0x5142f5 in run_mod /home/test/check/PythonASAN/Python/pythonrun.c:980
#172 0x5142f5 in PyRun_FileExFlags /home/test/check/PythonASAN/Python/pythonrun.c:933
#173 0x5142f5 in ?? ??:0
#174 0x512afa in PyRun_SimpleFileExFlags /home/test/check/PythonASAN/Python/pythonrun.c:396
#175 0x512afa in ?? ??:0
#176 0x53eefd in run_file /home/test/check/PythonASAN/Modules/main.c:320
#177 0x53eefd in Py_Main /home/test/check/PythonASAN/Modules/main.c:780
#178 0x53eefd in ?? ??:0
#179 0x503d16 in main /home/test/check/PythonASAN/./Programs/python.c:69
#180 0x503d16 in ?? ??:0
#181 0x7ff69c1fc82f in __libc_start_main /build/glibc-GKVZIf/glibc-2.23/csu/../csu/libc-start.c:291
#182 0x7ff69c1fc82f in ?? ??:0
#183 0x432548 in _start ??:?
#184 0x432548 in ?? ??:0
0x60200000e738 is located 0 bytes to the right of 8-byte region [0x60200000e730,0x60200000e738)
allocated by thread T0 here:
#0 0x4d2678 in malloc ??:?
#1 0x4d2678 in ?? ??:0
#2 0x7ff6984359bc in my_wcsdup /home/test/check/PythonASAN/Modules/_ctypes/_ctypes_test.c:185 (discriminator 1)
#3 0x7ff6984359bc in ?? ??:0
#2 0x7ffe3c29661f (<unknown module>)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/test/check/PythonASAN/python+0x58bc2a)
Shadow bytes around the buggy address:
0x0c047fff9c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9cc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff9cd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9ce0: fa fa fa fa fa fa 00[fa]fa fa fd fa fa fa fd fa
0x0c047fff9cf0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9d00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9d10: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9d20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
0x0c047fff9d30: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==18067==ABORTING |
|
Date |
User |
Action |
Args |
2017-02-08 14:41:43 | beginvuln | set | recipients:
+ beginvuln |
2017-02-08 14:41:42 | beginvuln | set | messageid: <1486564902.18.0.325996539342.issue29484@psf.upfronthosting.co.za> |
2017-02-08 14:41:42 | beginvuln | link | issue29484 messages |
2017-02-08 14:41:41 | beginvuln | create | |
|