Recent changes to bugs

Yet another Valgrind uninit warning (SECURITY?)

David Wagner — Fri, 11 Jul 2008 04:02:30 -0000

Here's another file that reveals still more Valgrind warnings:
http://www.cs.berkeley.edu/~daw/tmp/bug9.lzo
These are different warnings than the others I've reported so far, so I'm reporting separately as they may reflect a different set of bugs.

Valgrind's output:
==5874== Memcheck, a memory error detector.
==5874== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==5874== Using LibVEX rev 1804, a library for dynamic binary translation.
==5874== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==5874== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==5874== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==5874== For more details, rerun with: -v
==5874==
==5874== Conditional jump or move depends on uninitialised value(s)
==5874== at 0x3D53E13F31: lzo1x_decompress_safe (lzo1x_d.ch:249)
==5874== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==5874== by 0x4073B0: x_decompress (compress.c:315)
==5874== by 0x405FE6: do_decompress (lzop.c:2035)
==5874== by 0x40648E: do_one_file (lzop.c:2053)
==5874== by 0x406B69: main (lzop.c:2115)
==5874==
==5874== Conditional jump or move depends on uninitialised value(s)
==5874== at 0x3D53E13F36: lzo1x_decompress_safe (lzo1x_d.ch:249)
==5874== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==5874== by 0x4073B0: x_decompress (compress.c:315)
==5874== by 0x405FE6: do_decompress (lzop.c:2035)
==5874== by 0x40648E: do_one_file (lzop.c:2053)
==5874== by 0x406B69: main (lzop.c:2115)
==5874==
==5874== Use of uninitialised value of size 8
==5874== at 0x3D53E13F5D: lzo1x_decompress_safe (lzo1x_d.ch:398)
==5874== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==5874== by 0x4073B0: x_decompress (compress.c:315)
==5874== by 0x405FE6: do_decompress (lzop.c:2035)
==5874== by 0x40648E: do_one_file (lzop.c:2053)
==5874== by 0x406B69: main (lzop.c:2115)
==5874==
==5874== Use of uninitialised value of size 8
==5874== at 0x3D53E13F78: lzo1x_decompress_safe (lzo1x_d.ch:399)
==5874== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==5874== by 0x4073B0: x_decompress (compress.c:315)
==5874== by 0x405FE6: do_decompress (lzop.c:2035)
==5874== by 0x40648E: do_one_file (lzop.c:2053)
==5874== by 0x406B69: main (lzop.c:2115)
==5874==
==5874== Use of uninitialised value of size 8
==5874== at 0x3D53E13F89: lzo1x_decompress_safe (lzo1x_d.ch:399)
==5874== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==5874== by 0x4073B0: x_decompress (compress.c:315)
==5874== by 0x405FE6: do_decompress (lzop.c:2035)
==5874== by 0x40648E: do_one_file (lzop.c:2053)
==5874== by 0x406B69: main (lzop.c:2115)
lzop: bug9.lzo: Compressed data violation
==5874==
==5874== ERROR SUMMARY: 8 errors from 5 contexts (suppressed: 4 from 1)

Still more Valgrind uninit warnings (SECURITY?)

David Wagner — Thu, 10 Jul 2008 23:21:17 -0000

Here's a file that reveals still more Valgrind warnings:
http://www.cs.berkeley.edu/~daw/tmp/bug7.lzo

This might be related to bugs #2015363 and #2015365.

Valgrind output from valgrind lzop -d bug7.lzo:

==22744== Memcheck, a memory error detector.
==22744== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==22744== Using LibVEX rev 1804, a library for dynamic binary translation.
==22744== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==22744== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==22744== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==22744== For more details, rerun with: -v
==22744==
==22744== Conditional jump or move depends on uninitialised value(s)
==22744== at 0x3D53E14007: lzo1x_decompress_safe (lzo1x_d.ch:376)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Conditional jump or move depends on uninitialised value(s)
==22744== at 0x3D53E14010: lzo1x_decompress_safe (lzo1x_d.ch:376)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Conditional jump or move depends on uninitialised value(s)
==22744== at 0x3D53E14041: lzo1x_decompress_safe (lzo1x_d.ch:383)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Use of uninitialised value of size 8
==22744== at 0x3D53E13F5D: lzo1x_decompress_safe (lzo1x_d.ch:398)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Use of uninitialised value of size 8
==22744== at 0x3D53E13F78: lzo1x_decompress_safe (lzo1x_d.ch:399)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Use of uninitialised value of size 8
==22744== at 0x3D53E13F89: lzo1x_decompress_safe (lzo1x_d.ch:399)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
==22744==
==22744== Conditional jump or move depends on uninitialised value(s)
==22744== at 0x3D53E13CD8: lzo1x_decompress_safe (lzo1x_d.ch:410)
==22744== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==22744== by 0x4073B0: x_decompress (compress.c:315)
==22744== by 0x405FE6: do_decompress (lzop.c:2035)
==22744== by 0x40648E: do_one_file (lzop.c:2053)
==22744== by 0x406B69: main (lzop.c:2115)
lzop: bug5b.lzo: Compressed data violation
==22744==
==22744== ERROR SUMMARY: 2649 errors from 7 contexts (suppressed: 4 from 1)

This may well be a duplicate of the two earlier bugs I've reproduced (or at least related to them), but I wanted to share this test case as well since it seems to trigger even more errors, and from slightly different line numbers.

Temporarily marked private, in case this has any security implications.

Valgrind: More uninit in lzo1x_decompress_safe() (SECURITY?)

David Wagner — Thu, 10 Jul 2008 20:44:37 -0000

Valgrind reports multiple warnings: lzo1x_decompress_safe() read and uses uninitialized values. This is 100% reproducible.

To reproduce, download this file:
http://www.cs.berkeley.edu/~daw/tmp/bug4.lzo
Now run valgrind lzop -d bug4.lzo. You get:

==28708== Memcheck, a memory error detector.
==28708== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==28708== Using LibVEX rev 1804, a library for dynamic binary translation.
==28708== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==28708== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==28708== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==28708== For more details, rerun with: -v
==28708==
==28708== Conditional jump or move depends on uninitialised value(s)
==28708== at 0x3D53E13C8F: lzo1x_decompress_safe (lzo1x_d.ch:191)
==28708== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==28708== by 0x4073B0: x_decompress (compress.c:315)
==28708== by 0x405FE6: do_decompress (lzop.c:2035)
==28708== by 0x40648E: do_one_file (lzop.c:2053)
==28708== by 0x406B69: main (lzop.c:2115)
==28708==
==28708== Conditional jump or move depends on uninitialised value(s)
==28708== at 0x3D53E13C98: lzo1x_decompress_safe (lzo1x_d.ch:191)
==28708== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==28708== by 0x4073B0: x_decompress (compress.c:315)
==28708== by 0x405FE6: do_decompress (lzop.c:2035)
==28708== by 0x40648E: do_one_file (lzop.c:2053)
==28708== by 0x406B69: main (lzop.c:2115)
==28708==
==28708== Use of uninitialised value of size 8
==28708== at 0x3D53E13CB1: lzo1x_decompress_safe (lzo1x_d.ch:192)
==28708== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==28708== by 0x4073B0: x_decompress (compress.c:315)
==28708== by 0x405FE6: do_decompress (lzop.c:2035)
==28708== by 0x40648E: do_one_file (lzop.c:2053)
==28708== by 0x406B69: main (lzop.c:2115)
lzop: bug4.lzo: Compressed data violation
==28708==
==28708== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 4 from 1)

In general this kind of uninitialized use bug can represent a potential for a security vulnerability. I have not analyzed whether this particular bug has any security implications, but because of this risk, I am marking this bug as private for now so that you can investigate and push out a security patch should this represent a security risk. I plan to mark this bug as
public on July 17th, unless I hear otherwise.

Reproduced on Fedora 9 x86_64 with these RPMs:
lzop-1.02-0.6.rc1.fc9.x86_64
lzo-2.02-5.fc9.x86_64
lzo-debuginfo-2.02-5.fc9.x86_64

Valgrind: uninit bug in lzo1x_decompress_safe() (SECURITY?)

David Wagner — Thu, 10 Jul 2008 20:41:48 -0000

Valgrind reports a bug: lzo1x_decompress_safe() reads an uninitialized value. This is 100% reproducible.

To reproduce, download this file:
http://www.cs.berkeley.edu/~daw/tmp/bug3.lzo
Now run valgrind lzop -d bug3.lzo. You get:

==27446== Memcheck, a memory error detector.
==27446== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==27446== Using LibVEX rev 1804, a library for dynamic binary translation.
==27446== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==27446== Using valgrind-3.3.0, a dynamic binary instrumentation framework.
==27446== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==27446== For more details, rerun with: -v
==27446==
==27446== Conditional jump or move depends on uninitialised value(s)
==27446== at 0x3D53E1415B: lzo1x_decompress_safe (lzo1x_d.ch:333)
==27446== by 0x4083D9: lzo_decompress (p_lzo.c:516)
==27446== by 0x4073B0: x_decompress (compress.c:315)
==27446== by 0x405FE6: do_decompress (lzop.c:2035)
==27446== by 0x40648E: do_one_file (lzop.c:2053)
==27446== by 0x406B69: main (lzop.c:2115)
lzop: bug3.lzo: Compressed data violation
==27446==
==27446== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 4 from 1)

Reproduced on Fedora 9 x86_64 with these RPMs:
lzop-1.02-0.6.rc1.fc9.x86_64
lzo-2.02-5.fc9.x86_64
lzo-debuginfo-2.02-5.fc9.x86_64