{"action":"opened","issue":{"url":"https://api.github.com/repos/libimobiledevice/libplist/issues/95","repository_url":"https://api.github.com/repos/libimobiledevice/libplist","labels_url":"https://api.github.com/repos/libimobiledevice/libplist/issues/95/labels{/name}","comments_url":"https://api.github.com/repos/libimobiledevice/libplist/issues/95/comments","events_url":"https://api.github.com/repos/libimobiledevice/libplist/issues/95/events","html_url":"https://github.com/libimobiledevice/libplist/issues/95","id":206097883,"number":95,"title":"heap-buffer-overflow in parse_string_node","user":{"login":"zhunki","id":11497172,"avatar_url":"https://avatars.githubusercontent.com/u/11497172?v=3","gravatar_id":"","url":"https://api.github.com/users/zhunki","html_url":"https://github.com/zhunki","followers_url":"https://api.github.com/users/zhunki/followers","following_url":"https://api.github.com/users/zhunki/following{/other_user}","gists_url":"https://api.github.com/users/zhunki/gists{/gist_id}","starred_url":"https://api.github.com/users/zhunki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhunki/subscriptions","organizations_url":"https://api.github.com/users/zhunki/orgs","repos_url":"https://api.github.com/users/zhunki/repos","events_url":"https://api.github.com/users/zhunki/events{/privacy}","received_events_url":"https://api.github.com/users/zhunki/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-02-08T05:08:19Z","updated_at":"2017-02-08T05:08:19Z","closed_at":null,"body":"==4536== ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb5e0074e at pc 0x806616b bp 0xbfabe008 sp 0xbfabdffc\r\nWRITE of size 1 at 0xb5e0074e thread T0\r\n    #0 0x806616a in parse_string_node /home/b/asan/libplist/src/bplist.c:298\r\n    #1 0x806616a in parse_bin_node /home/b/asan/libplist/src/bplist.c:668\r\n    #2 0x806616a in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:755\r\n    #3 0x80632a0 in parse_dict_node /home/b/asan/libplist/src/bplist.c:461\r\n    #4 0x80632a0 in parse_bin_node /home/b/asan/libplist/src/bplist.c:697\r\n    #5 0x80632a0 in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:755\r\n    #6 0x8068b30 in plist_from_bin /home/b/asan/libplist/src/bplist.c:844\r\n    #7 0x804a175 in main /home/b/asan/libplist/tools/plistutil.c:150\r\n    #8 0xb5f9ba82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)\r\n    #9 0x804aef5 in _start (/home/b/asan/libplist/tools/plistutil+0x804aef5)\r\n0xb5e0074e is located 2 bytes to the left of 1-byte region [0xb5e00750,0xb5e00751)\r\nallocated by thread T0 here:\r\n    #0 0xb6163854 (/usr/lib/i386-linux-gnu/libasan.so.0+0x16854)\r\n    #1 0x8063b7c in parse_string_node /home/b/asan/libplist/src/bplist.c:292\r\n    #2 0x8063b7c in parse_bin_node /home/b/asan/libplist/src/bplist.c:668\r\n    #3 0x8063b7c in parse_bin_node_at_index /home/b/asan/libplist/src/bplist.c:755\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /home/b/asan/libplist/src/bplist.c:298 parse_string_node\r\nShadow bytes around the buggy address:\r\n  0x36bc0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc00c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc00d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n=>0x36bc00e0: fa fa fa fa fa fa fa fa fa[fa]01 fa fa fa 00 04\r\n  0x36bc00f0: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04\r\n  0x36bc0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc0120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x36bc0130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:     fa\r\n  Heap righ redzone:     fb\r\n  Freed Heap region:     fd\r\n  Stack left redzone:    f1\r\n  Stack mid redzone:     f2\r\n  Stack right redzone:   f3\r\n  Stack partial redzone: f4\r\n  Stack after return:    f5\r\n  Stack use after scope: f8\r\n  Global redzone:        f9\r\n  Global init order:     f6\r\n  Poisoned by user:      f7\r\n  ASan internal:         fe\r\n[poc.txt](https://github.com/libimobiledevice/libplist/files/759765/poc.txt)\r\n"}}
{"actor":{"display_login":"zhunki"}}