Out of bounds call to strncpy() in function Elf64_r_bin_elf_get_libs() on malformed input

[hannob]

A malformed elf file can cause an out of bounds access in radare2. Here's the file:
https://crashes.fuzzing-project.org/radare2-oob-heap-read-Elf64_r_bin_elf_get_libs

To see this one needs to compile radare2 with address sanitizer (add -fsanitize=address to cflags). This issue was found with the help of the tool american fuzzy lop.

Here's the output from address sanitizer:

Warning: Cannot initialize section headers
Warning: Cannot initialize strings table
=================================================================
==13080==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400000ba00 at pc 0x7f208de69be7 bp 0x7fff5165d770 sp 0x7fff5165cf18
READ of size 2 at 0x60400000ba00 thread T0
    #0 0x7f208de69be6 in __interceptor_strncpy (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x2ebe6)
    #1 0x7f208c8afb2e in strncpy /usr/include/bits/string3.h:120
    #2 0x7f208c8afb2e in Elf64_r_bin_elf_get_libs /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:1197
    #3 0x7f208c8829fb in libs /f/radare2/radare2/libr/..//libr/bin/p/bin_elf.c:380
    #4 0x7f208c7b85a5 in r_bin_object_set_items /f/radare2/radare2/libr/bin/bin.c:423
    #5 0x7f208c7b85a5 in r_bin_object_new /f/radare2/radare2/libr/bin/bin.c:945
    #6 0x7f208c7bea68 in r_bin_file_new_from_bytes /f/radare2/radare2/libr/bin/bin.c:1056
    #7 0x7f208c7bea68 in r_bin_load_io_at_offset_as_sz /f/radare2/radare2/libr/bin/bin.c:644
    #8 0x7f208c7c053a in r_bin_load_io_at_offset_as /f/radare2/radare2/libr/bin/bin.c:666
    #9 0x7f208c7c1865 in r_bin_load_io /f/radare2/radare2/libr/bin/bin.c:546
    #10 0x7f208d819aa0 in r_core_file_do_load_for_io_plugin /f/radare2/radare2/libr/core/file.c:350
    #11 0x7f208d819aa0 in r_core_bin_load /f/radare2/radare2/libr/core/file.c:487
    #12 0x4057fc in main /f/radare2/radare2/binr/radare2/radare2.c:579
    #13 0x7f2087afef9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
    #14 0x409dfe (/mnt/ram/radare2/radare2+0x409dfe)

0x60400000ba00 is located 0 bytes to the right of 48-byte region [0x60400000b9d0,0x60400000ba00)
allocated by thread T0 here:
    #0 0x7f208de92855 in calloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x57855)
    #1 0x7f208c89be71 in Elf64_r_bin_elf_init_dynamic_section /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:294
    #2 0x7f208c89be71 in Elf64_r_bin_elf_init /f/radare2/radare2/libr/..//libr/bin/p/../format/elf/elf.c:338

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __interceptor_strncpy
Shadow bytes around the buggy address:
  0x0c087fff96f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c087fff9730: fa fa 00 00 00 00 00 07 fa fa 00 00 00 00 00 00
=>0x0c087fff9740:[fa]fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff9750: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
  0x0c087fff9760: fa fa 00 00 00 00 00 07 fa fa 00 00 00 00 00 07
  0x0c087fff9770: fa fa 00 00 00 00 00 07 fa fa fd fd fd fd fd fd
  0x0c087fff9780: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 07
  0x0c087fff9790: fa fa 00 00 00 00 00 07 fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==13080==ABORTING

[jjdredd]

use ```, luke

[C-H-A-I-R]

that download link does not wok

[radare]

403

[hannob]

sorry, permission problem, fixed now.

[alvarofe]

Thanks. I will work on this :)