[redland-dev] [Raptor RDF Syntax Library 0000617]: heap buffer overflow in raptor_qname_format_as_xml
Mantis Bug Tracker
mantis-bug-sender at librdf.org
Sat Apr 15 17:55:31 EDT 2017
The following issue has been SUBMITTED.
======================================================================
http://bugs.librdf.org/mantis/view.php?id=617
======================================================================
Reported By: hanno
Assigned To:
======================================================================
Project: Raptor RDF Syntax Library
Issue ID: 617
Category: api
Reproducibility: always
Severity: crash
Priority: normal
Status: new
Syntax Name:
======================================================================
Date Submitted: 2017-04-15 14:55
Last Modified: 2017-04-15 14:55
======================================================================
Summary: heap buffer overflow in raptor_qname_format_as_xml
Description:
The attached file will cause a heap buffer overflow in raptor. Can be tested
with the rapper command line tool.
This is a security bug, so I'm marking this private.
Here's a stack trace of the crash (from address sanitizer):
==24627==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000002090
at pc 0x000000529a9c bp 0x7fffc7e52060 sp 0x7fffc7e52058
WRITE of size 8 at 0x604000002090 thread T0
#0 0x529a9b in raptor_qname_format_as_xml
/f/raptor/raptor2-2.0.15/src/raptor_qname.c:666:15
#1 0x5cb770 in raptor_xml_writer_start_element_common
/f/raptor/raptor2-2.0.15/src/raptor_xml_writer.c:242:9
#2 0x5cd317 in raptor_xml_writer_start_element
/f/raptor/raptor2-2.0.15/src/raptor_xml_writer.c:571:3
#3 0x55c534 in raptor_rdfxml_start_element_grammar
/f/raptor/raptor2-2.0.15/src/raptor_rdfxml.c:2044:9
#4 0x55c534 in raptor_rdfxml_start_element_handler
/f/raptor/raptor2-2.0.15/src/raptor_rdfxml.c:830
#5 0x54d8e6 in raptor_sax2_start_element
/f/raptor/raptor2-2.0.15/src/raptor_sax2.c:826:5
#6 0x7efcbd5decad in xmlParseStartTag (/usr/lib64/libxml2.so.2+0x41cad)
#7 0x7efcbd5ec323 (/usr/lib64/libxml2.so.2+0x4f323)
#8 0x7efcbd5ed3ba in xmlParseChunk (/usr/lib64/libxml2.so.2+0x503ba)
#9 0x54c2e7 in raptor_sax2_parse_chunk
/f/raptor/raptor2-2.0.15/src/raptor_sax2.c:534:10
#10 0x558ec9 in raptor_rdfxml_parse_chunk
/f/raptor/raptor2-2.0.15/src/raptor_rdfxml.c:1169:8
#11 0x512da5 in raptor_parser_parse_chunk
/f/raptor/raptor2-2.0.15/src/raptor_parse.c:482:10
#12 0x512da5 in raptor_parser_parse_file_stream
/f/raptor/raptor2-2.0.15/src/raptor_parse.c:554
#13 0x51324f in raptor_parser_parse_file
/f/raptor/raptor2-2.0.15/src/raptor_parse.c:616:8
#14 0x50dd82 in main /f/raptor/raptor2-2.0.15/utils/rapper.c:917:8
#15 0x7efcbc4d52b0 in __libc_start_main (/lib64/libc.so.6+0x202b0)
#16 0x41b919 in _start (/r/raptor/rapper+0x41b919)
======================================================================
Issue History
Date Modified Username Field Change
======================================================================
2017-04-15 14:55 hanno New Issue
2017-04-15 14:55 hanno File Added:
raptor-heapoverflow-raptor_qname_format_as_xml.rdf
======================================================================
More information about the redland-dev
mailing list