Bug 265119 - bmake ParseDependency() can read off the end of its input buffer
Summary: bmake ParseDependency() can read off the end of its input buffer
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: misc (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Simon J. Gerraty
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-09 20:21 UTC by Robert Morris
Modified: 2024-01-11 21:53 UTC (History)
2 users (show)

See Also:
linimon: mfc-stable13?


Attachments
A makefile filled with garbage that illustrates a bug in bmake. (16 bytes, application/octet-stream)
2022-07-09 20:21 UTC, Robert Morris
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2022-07-09 20:21:22 UTC
Created attachment 235154 [details]
A makefile filled with garbage that illustrates a bug in bmake.

In this code in bmake's parse.c:

static GNodeType
ParseDependencyOp(char **pp)
{
	if (**pp == '!')
		return (*pp)++, OP_FORCE;
	if ((*pp)[1] == ':')
		return *pp += 2, OP_DOUBLEDEP;
	else
		return (*pp)++, OP_DEPENDS;
}

If bmake's parser has reached the end of the input, so that
**pp == '\0', then it executes the last line, incrementing *pp and
causing the parser to venture into the unknown.

I'm using a recent FreeBSD-current, on amd64, and /usr/src/contrib/bmake
says _MAKE_VERSION=20220208

You can see the problem by compiling bmake with -fsanitize=address,
and running it against the attached (broken) Makefile:

% ./bmake -f bmake4b.out
make: "bmake4b.out" line 2: Invalid line type
make: "bmake4b.out" line 4: Unclosed variable ""
=================================================================
==92690==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000008d34 at pc 0x0000011866c5 bp 0x7fffffffe200 sp 0x7fffffffe1f8
READ of size 1 at 0x602000008d34 thread T0
    #0 0x11866c4 in ParseDependencyOp contrib/bmake/parse.c:1117:6
    #1 0x11858fd in ParseDependency contrib/bmake/parse.c:1480:26
    #2 0x1182685 in ParseDependencyLine contrib/bmake/parse.c:2821:2
    #3 0x117b780 in ParseLine contrib/bmake/parse.c:2872:2
    #4 0x117aa02 in Parse_File contrib/bmake/parse.c:2897:4
    #5 0x115fe72 in ReadMakefile contrib/bmake/main.c:1709:3
    #6 0x115f74f in ReadAllMakefiles contrib/bmake/main.c:1300:8
    #7 0x11574fd in main_ReadFiles contrib/bmake/main.c:1516:3
    #8 0x1156946 in main contrib/bmake/main.c:1645:2
Comment 1 Simon J. Gerraty freebsd_committer freebsd_triage 2022-07-23 17:24:53 UTC
Thanks for the report - this is being looked at upstream
Comment 2 Simon J. Gerraty freebsd_committer freebsd_triage 2022-07-26 16:17:30 UTC
Fixed in bmake-20220724 which was just imported to main
Comment 3 Mark Linimon freebsd_committer freebsd_triage 2024-01-10 04:23:15 UTC
^Triage: assign to committer that resolved.