Posibble Bug: Stack Buffer Underflow in `tinyxml2::XMLPrinter::PrepareForNewNode(bool)`

Aperta
  • Qualcosa non va?
#1,030 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
1-2 giorni
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Ferma
Stack tecnologico
cpp
Ambito
data

Direzione di ricerca

The report points at XMLPrinter::PrepareForNewNode near line 2739 of tinyxml2.cpp, but the fuzz driver only exercises StrPair (SetStr, Reset, Empty), so first check whether that code path can reach the printer at all. Build with AddressSanitizer and run the driver on the reported input to see if the underflow reproduces. Done means either a reproducer that actually hits PrepareForNewNode with a fix, or a documented finding that the report is not reproducible.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

🐞 Bug Report: Stack Buffer Underflow in tinyxml2::XMLPrinter::PrepareForNewNode(bool)
🔤 Summary

A stack buffer underflow vulnerability was detected in the function tinyxml2::XMLPrinter::PrepareForNewNode(bool) located in tinyxml2.cpp at line 2739. The issue occurs when reading from an invalid memory address on the stack, potentially leading to information leakage or arbitrary code execution.

📍 Location
  • File: tinyxml2.cpp
  • Function: tinyxml2::XMLPrinter::PrepareForNewNode(bool)
  • Line: 2739
🧪 Reproduction Steps

This issue was triggered using the following fuzzing test driver:

extern "C" int LLVMFuzzerTestOneInput_0(const uint8_t *fuzz_data, size_t fuzz_size) {
    FuzzedDataProvider provider(fuzz_data, fuzz_size);
    std::string tmp_string_content_0 = provider.ConsumeRandomLengthString();
    const char* string_content_0 = tmp_string_content_0.c_str();

    StrPair strPair;
    strPair.SetStr(string_content_0);
    strPair.Reset();
    strPair.Empty();

    return 0;
}

Although this test case does not directly invoke XML printing functionality, it indirectly leads to a call to PrepareForNewNode() through internal XML processing logic.

🧠 Root Cause Analysis

The function PrepareForNewNode() performs a read operation that accesses memory outside the valid stack frame:

void XMLPrinter::PrepareForNewNode( bool compactMode )
{
    SealElementIfJustOpened();

    if ( compactMode ) {
        return;
    }

    if ( _firstElement ) {
        PrintSpace (_depth); // ← Possible out-of-bounds access here
    } else if ( _textDepth < 0 ) {
        Putc( '\n' );
        PrintSpace( _depth );
    }

    _firstElement = false;
}

The problem occurs inside the call to PrintSpace(_depth), where _depth may be used to calculate an invalid offset on the stack buffer. AddressSanitizer reports a stack-buffer-underflow , indicating that the code reads before the start of a local variable's allocated space.

This is likely due to incorrect bounds checking or improper handling of _depth when computing indentation spaces.

🚨 ASan Error Output
==2875063==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffce45545b8
READ of size 4 at 0x7ffce45545b8 thread T0
#0 0x55bef7268b8d in tinyxml2::XMLPrinter::PrepareForNewNode(bool)
...
SUMMARY: AddressSanitizer: stack-buffer-underflow /data/cpput_vol/utscript/projects/tinyxml2/tinyxml2_4/tinyxml2.cpp:2739

AddressSanitizer confirms that the read access occurred before the beginning of a local stack object.

Lingua principale
C++
Stelle
5.8k
Fork
2k
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di leethomason/tinyxml2

Tutte le issue di leethomason/tinyxml2

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.