[Bug glob/30635] New: stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[Bug glob/30635] New: stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

            Bug ID: 30635
           Summary: stack-overflow
                    /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:5
                    46:9 in glob64
           Product: glibc
           Version: 2.31
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: glob
          Assignee: unassigned at sourceware dot org
          Reporter: 372091606 at qq dot com
  Target Milestone: ---

Created attachment 14963
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14963&action=edit
The poc and ASAN report of glob stack-buffer-overflow

When I was fuzzing the logrotate program, I discovered a glob stack overflow
vulnerability, details of which can be seen in the 0x02 section of the link
below:

https://github.com/logrotate/logrotate/issues/533

Poc 0x02 seems to be an issue in the glob(3) implementation of glibc, since the
man page does not mention any limitations on the supported input or offers a
flag for secure operations on user controlled input. 

Reproduction steps are as follows:

```
$ git clone https://github.com/logrotate/logrotate

$ cd logrotate

$ CC=clang CXX=clang++ CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer"
CXXFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" ./configure

$ make

$ ./logrotate -d ./poc2_stack_overflow 
```

```
$ ls -al /lib/x86_64-linux-gnu/libc.so.6                                        
lrwxrwxrwx 1 root root  /lib/x86_64-linux-gnu/libc.so.6 -> libc-2.31.so
```

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/30635] stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

blu3sh0rk <372091606 at qq dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |glibc_2.31
                 CC|                            |372091606 at qq dot com
                URL|                            |https://github.com/logrotat
                   |                            |e/logrotate/issues/533

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/30635] stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

--- Comment #1 from blu3sh0rk <372091606 at qq dot com> ---
Created attachment 15099
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15099&action=edit
fuzz harness for glob() and poc

```
$ glob.c -g -fsanitize=address -o fuzz_glob

$ ./fuzz_glob poc

```
SUMMARY: AddressSanitizer: stack-overflow
/build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:289:1 in glob64

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/30635] stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

--- Comment #2 from blu3sh0rk <372091606 at qq dot com> ---
fuzz harness for glob() and poc

```
$ gcc -g -fsanitize=address -o fuzz_glob

$ ./fuzz_glob poc

```
SUMMARY: AddressSanitizer: stack-overflow
/build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:289:1 in glob64

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/30635] stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

--- Comment #3 from blu3sh0rk <372091606 at qq dot com> ---
fuzz harness for glob() and poc

```
$ gcc gloib.c -g -fsanitize=address -o fuzz_glob

$ ./fuzz_glob poc

```
SUMMARY: AddressSanitizer: stack-overflow
/build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:289:1 in glob64

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug glob/30635] stack-overflow /build/glibc-SzIz7B/glibc-2.31/posix/../posix/glob.c:546:9 in glob64

[372091606 at qq dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30635

--- Comment #4 from blu3sh0rk <372091606 at qq dot com> ---

Sorry for continuously outputting incorrect commands. The correct one should
be: 

```
gcc glob.c -g -fsanitize=address -o fuzz_glob
```

Moreover, this vulnerability also exists in version 2.35.

-- 
You are receiving this mail because:
You are on the CC list for the bug.