OOM on huge allocation on malformed input (found through fuzzing)

[5225225]

Minimised base64 input: CgAAAAQAAAAAAA==

Stack trace:

==3694748==ERROR: AddressSanitizer: requested allocation size 0xfffffffffffffffc (0x800 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x55e5687daf12 in calloc /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
    #1 0x55e56881c330 in bson::de::ensure_read_exactly::hf5185d965cc60fad (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x21f330)
    #2 0x55e568819981 in bson::de::deserialize_array::ha4650ca0cb324222 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x21c981)
    #3 0x55e56881e3da in bson::de::deserialize_bson_kvp::hec5fdee461eb2b1b (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x2213da)
    #4 0x55e568828b98 in bson::document::Document::decode::_$u7b$$u7b$closure$u7d$$u7d$::hf6f570c9035f9cf2 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x22bb98)
    #5 0x55e56881bcab in bson::de::ensure_read_exactly::h6a68518f15fd1165 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x21ecab)
    #6 0x55e568828653 in bson::document::Document::decode::hab1f24b5dff83160 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x22b653)
    #7 0x55e56884eb2c in rust_fuzzer_test_input (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x251b2c)
    #8 0x55e568c35280 in __rust_try (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x638280)
    #9 0x55e568c34edf in LLVMFuzzerTestOneInput (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x637edf)
    #10 0x55e568c2c104 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x62f104)
    #11 0x55e568c2c882 in fuzzer::Fuzzer::MinimizeCrashLoop(std::vector<unsigned char, fuzzer::fuzzer_allocator<unsigned char> > const&) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x62f882)
    #12 0x55e568c1b0ef in fuzzer::MinimizeCrashInputInternalStep(fuzzer::Fuzzer*, fuzzer::InputCorpus*) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x61e0ef)
    #13 0x55e568c2500d in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x62800d)
    #14 0x55e56875f142 in main (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x162142)
    #15 0x7f4586739b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)

[5225225]

Minimal test program. Must be run with --release (or otherwise debug assertions off), or you will get an "attempted to subtract with overflow"

fn main() {
    let crash = b"\n\x00\x00\x00\x04\x00\x00\x00\x00\x00";
    let mut reader = std::io::Cursor::new(crash);
    let _ = bson::Document::from_reader(&mut reader);
}

Tested this both on the latest git version as well as the latest version from crates.io, and it seems to happen on both.

[pooooodles]

tracked in https://jira.mongodb.org/browse/RUST-713

[5225225]

After checking out the pull request for the fixed branch and running the fuzzer, I get a similar OOM issue (in de::deserialize_bson_kvp if I recall correctly). I can open a new issue after this gets merged with the details for that, unless you want me to make it now?

[gperinazzo]

Could you post the input here? If it's quick to fix I can see if I can include it on the MR.

Do you get this new error on master as well?

[5225225]

fn main() {
    let crash = b".\x00\x00\x00\x05\x01\x00\x00\x00\x00\x00\x02\xfc\xff\xff\xff\xff\xff\xff\xff\x00\x00*\x00h\x0e\x10++\x00h\x0e++\x00\x00\t\x00\x00\x00\x00\x00*\x0e\x10++" ;
    let mut reader = std::io::Cursor::new(crash);
    let _ = bson::Document::from_reader(&mut reader);
}

This happens on both master as well as the fixed branch.

When running with asan, this is the error I get:

==1850704==ERROR: AddressSanitizer: requested allocation size 0xfffffffffffffffc (0x800 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
    #0 0x55ef06be059d in malloc /rustc/llvm/src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x55ef06c28d6a in bson::de::deserialize_bson_kvp::hec5fdee461eb2b1b (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x239d6a)
    #2 0x55ef06c2e858 in bson::document::Document::decode::_$u7b$$u7b$closure$u7d$$u7d$::hf6f570c9035f9cf2 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x23f858)
    #3 0x55ef06c2193b in bson::de::ensure_read_exactly::h6a68518f15fd1165 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x23293b)
    #4 0x55ef06c2e313 in bson::document::Document::decode::hab1f24b5dff83160 (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x23f313)
    #5 0x55ef06c5489c in rust_fuzzer_test_input (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x26589c)
    #6 0x55ef07031b00 in __rust_try (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x642b00)
    #7 0x55ef0703175f in LLVMFuzzerTestOneInput (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x64275f)
    #8 0x55ef07028984 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x639984)
    #9 0x55ef0701cdca in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x62ddca)
    #10 0x55ef07020a22 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x631a22)
    #11 0x55ef06b64942 in main (/home/jess/.cache/cargo/target/x86_64-unknown-linux-gnu/release/deserialize+0x175942)
    #12 0x7fd6fcc10b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24)

Also, this doesn't seem to rely on an overflow (it crashes with a memory allocation failed, even when running in debug mode), which is interesting.

[gperinazzo]

I looked into the code and managed to create a string that crashes as well (\x0F\x00\x00\x00\x05\x00\x00\x00\x00\x00\x02\xFC\xFF\xFF\xFF).

It's an easy fix, I'll update the PR.

[gperinazzo]

@5225225 Pushed the fix to the pull request. Thanks for finding these.

[5225225]

no worries, I'll leave a fuzzer running on 4b7c046 to look for anything else and report new bugs for anything else I find, but I think that's all the easy to find bugs done, at least just testing Document::from_reader not crashing.

[ValHeimer]

Maybe you can push a new release to crates.io to fix this (big) issue ?
Thank you