[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20261027102942.GN3542221@port70.net>
Date: Tue, 27 Oct 2026 11:29:42 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: Thai Duong <thai@...if.io>, musl@...ts.openwall.com
Subject: Re: [SECURITY] musl: out-of-bounds read in regexec()
backtracking (src/regex/regexec.c, 1.2.6)
* Szabolcs Nagy <nsz@...t70.net> [2026-10-27 02:03:32 +0100]:
> * Thai Duong <thai@...if.io> [2026-10-26 05:35:06 -0700]:
> > The full write-up and a source-level reproduction are in the attached
> > report, and the proof of concept is attached as ANT-2026-HMXB71C3.zip
> > and also mirrored at
> > https://drive.google.com/file/d/1AUXONoLV-U5XDuOvLk9IbjEEiRR8cI1p/view.
>
> where is the 'source-level reproduction' ?
>
> it should be a regcomp and a regexec call (2 lines of c code)
> but i see gibberish scripts that reference nonexistig things.
>
> such reports should clearly state which part was human verified
> and which bit is machine generated text.
>
> the pos handling is wrong so there is a bug, but it's not clear
> how to trigger oob read (i don't see the path that leads to oob
> string+so)
ok the oob pos is indeed enough to get oob string+so
i can repro it with
#include <locale.h>
#include <regex.h>
#include <stdlib.h>
#include <string.h>
int main()
{
regex_t re;
regmatch_t rm[3];
char *p = malloc(20);
memcpy(p,"ab_\xf1\x81\x81\x81_\xf1\x81\x81\x81_\xf1\x81\x81\x81__",20);
setlocale(0,"");
regcomp(&re,"\\(a\\|b\\|..*\\)_\\1_\\1\\(.\\)\\2",0);
regexec(&re,p,3,rm,0);
}
under valgrind:
...
==2797== Invalid read of size 1
==2797== at 0x48BDF7F: strncmp (vg_replace_strmem.c:718)
==2797== by 0x4023F45: tre_tnfa_run_backtrack (regexec.c:785)
==2797== by 0x4023F45: regexec (regexec.c:1014)
==2797== by 0x4001271: main (in /tmp/a.out)
==2797== Address 0x48c7054 is 0 bytes after a block of size 20 alloc'd
==2797== at 0x48B6733: malloc (vg_replace_malloc.c:446)
==2797== by 0x40011F8: main (in /tmp/a.out)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
