-
Notifications
You must be signed in to change notification settings - Fork 95
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix out of bounds memory read in onig_node_str_cat
#164
base: master
Are you sure you want to change the base?
Conversation
Given #165 and this PR, does it make sense to create a fork that accepts security patches and then use that fork? |
I have contemplated making local temporary changes in https://github.com/fluent/fluent-bit/tree/master/lib/onigmo. Making a temporary fork for security patches only until this repository gets back to life is an option if there are more dependent repositories willing to adopt it. In any case fluent-bit maintainers have to be convinced to make a change (either local patch or reference another fork), but they hesitate to accept security patches even in their code so far. |
Temporary fix until k-takata/Onigmo#164 is merged
Temporary fix until k-takata/Onigmo#164 is merged Signed-off-by: sashashura <[email protected]>
Temporary fix until k-takata/Onigmo#164 is merged Signed-off-by: sashashura <[email protected]>
Temporary fix until k-takata/Onigmo#164 is merged Signed-off-by: sashashura <[email protected]>
Temporary fix until k-takata/Onigmo#164 is merged Signed-off-by: sashashura <[email protected]>
Temporary fix until k-takata/Onigmo#164 is merged Signed-off-by: sashashura <[email protected]>
This PR fixes out of bounds memory read in
onig_node_str_cat
revealed by fuzzing fluent-bit:https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=46049
The root cause is that a call to
enclen
inside ofPFETCH
macro when called infetch_token
results in a call toonigenc_mbclen_approximate
.When the value of
p
passed to the function is\xec
even though it is the last byte in multibyte sequince (the next byte is unexpected string terminator \0) theonigenc_mbclen_approximate
returns it's size as 4. The size is added to the overall string length and results in reading past the end of the string.