{"action":"closed","issue":{"url":"https://api.github.com/repos/sosy-lab/sv-benchmarks/issues/535","repository_url":"https://api.github.com/repos/sosy-lab/sv-benchmarks","labels_url":"https://api.github.com/repos/sosy-lab/sv-benchmarks/issues/535/labels{/name}","comments_url":"https://api.github.com/repos/sosy-lab/sv-benchmarks/issues/535/comments","events_url":"https://api.github.com/repos/sosy-lab/sv-benchmarks/issues/535/events","html_url":"https://github.com/sosy-lab/sv-benchmarks/issues/535","id":275789829,"number":535,"title":"Potential overflow in some busybox tasks","user":{"login":"MartinSpiessl","id":33026673,"avatar_url":"https://avatars2.githubusercontent.com/u/33026673?v=4","gravatar_id":"","url":"https://api.github.com/users/MartinSpiessl","html_url":"https://github.com/MartinSpiessl","followers_url":"https://api.github.com/users/MartinSpiessl/followers","following_url":"https://api.github.com/users/MartinSpiessl/following{/other_user}","gists_url":"https://api.github.com/users/MartinSpiessl/gists{/gist_id}","starred_url":"https://api.github.com/users/MartinSpiessl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MartinSpiessl/subscriptions","organizations_url":"https://api.github.com/users/MartinSpiessl/orgs","repos_url":"https://api.github.com/users/MartinSpiessl/repos","events_url":"https://api.github.com/users/MartinSpiessl/events{/privacy}","received_events_url":"https://api.github.com/users/MartinSpiessl/received_events","type":"User","site_admin":false},"labels":[{"id":472360268,"url":"https://api.github.com/repos/sosy-lab/sv-benchmarks/labels/issue%20with%20benchmark","name":"issue with benchmark","color":"d93f0b","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-11-21T17:04:38Z","updated_at":"2017-11-22T17:30:58Z","closed_at":"2017-11-22T17:30:58Z","author_association":"CONTRIBUTOR","body":"Hi,\r\n\r\nThere are overflows in some of the busybox tasks. The problem originates from the the built-in function strerror that resolves an error id to an error string. This error string could in theory be very long, let's say of length INT_MAX-2 (neither the C standard nor GCC specify how these strings look like or what is the maximal length):\r\n```\r\n// in bb_perror_msg(const char *s, ...):\r\nreturn_value_strerror$1=strerror(*bb_errno); // gives string of arbitrary length\r\n```\r\nNow in some busybox tasks, the length of such a string retrieved by a call to strerror is calculated using the built-in strlen function:\r\n\r\n\r\n```\r\n// in bb_verror_msg(const char *s, va_list p, const char *strerr):\r\nif(!(strerr == ((const char *)((void *)0))))\r\n{\r\n  return_value_strlen$2=strlen(strerr); // strerr here is return_value_strerror$1 from above\r\n  tmp_if_expr$3 = return_value_strlen$2;\r\n}\r\nelse\r\n  tmp_if_expr$3 = (unsigned long int)0;\r\nstrerr_len = (signed int)tmp_if_expr$3;\r\n```\r\nThis length is then used in a signed integer addition where the overflow happens:\r\n```\r\n// in bb_perror_msg(const char *s, ...)\r\nreturn_value_realloc$5=realloc(\r\n    (void *)msg,\r\n    (unsigned long int)(applet_len + used + strerr_len + msgeol_len + 3) // overflow!\r\n);\r\n```\r\nI think this bug is legit though very unlikely to happen in reality (error messages should be much shorter than INT_MAX=2147483647). It looks like all files using ~~bb__simple_perror_msg~~ bb_verror_msg function to report errors are affected. These are the ~~15~~ 36 files:\r\n\r\n```\r\n$ grep bb_verror_msg c/busybox-1.22.0/*.i -l  |tee /dev/stderr |wc -l\r\nc/busybox-1.22.0/chgrp-incomplete_true-no-overflow_false-valid-memtrack.i\r\nc/busybox-1.22.0/chroot-incomplete_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/cut_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/date_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/du_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/echo_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/expand_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/fold_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/head_false-valid-deref.i\r\nc/busybox-1.22.0/head_true-no-overflow_true-valid-deref.i\r\nc/busybox-1.22.0/logname_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/ls-incomplete_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/mkdir_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/mkfifo-incomplete_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/od_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/printf_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/readlink_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/realpath_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/rm_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/seq_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/sleep_false-valid-deref.i\r\nc/busybox-1.22.0/sleep_true-no-overflow_true-valid-deref.i\r\nc/busybox-1.22.0/stty_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/sync_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/tac_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/tee_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/test-incomplete_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/touch_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/uname_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/uniq_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/usleep_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/uudecode_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/wc_false-unreach-call_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/whoami-incomplete_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/who_true-no-overflow_true-valid-memsafety.i\r\nc/busybox-1.22.0/yes_true-no-overflow_true-valid-memsafety.i\r\n36\r\n```\r\nI could make a pull request to fix these files and also make a unchanged copy with the false-no-overflow label. Or I could just fix the labels. Or just fix the programs. We normally choose the first of these three options, but I saw that this did not happen for busybox tasks in the past when there were similar problems. What is the rationale behind this?\r\n\r\nAlso I anticipate some discussion about this, that is why I opened this issue.\r\n\r\n"}}
{"actor":{"display_login":"dbeyer"}}