fuzz CVE-2019-1118

本文主要是介绍fuzz CVE-2019-1118，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！

这篇来分析一下CVE-2019-1118，问题为stack corruption in OpenType font handling due to negative cubeStackDepth

漏洞复现

搭建环境，简单复现一下

git clone https://github.com/adobe-type-tools/afdko
cd afdko
git checkout 2.8.8
cd c
bash buildalllinux.sh debug

根据给出的poc测试

可以发现，出错了，但是被afdko捕获了。

这样的话，在重点位置设一下断点，再来看一下

首先测试一下do_blend_cube.otf

pwndbg> b t2cstr.c:1057
Breakpoint 1 at 0x466af2: file ../../../../../source/t2cstr/t2cstr.c, line 1057.
pwndbg> run -cff do_blend_cube.otf

看一下效果

结合着反汇编代码看，效果可能更好

.text:0000000000466AF2                 mov     esi, [rbp+nBlends]
.text:0000000000466AF5                 mov     rdi, [rbp+h]
.text:0000000000466AF9                 add     rdi, 32D60h
.text:0000000000466B00                 mov     rax, [rbp+h]    ; h
.text:0000000000466B04                 movsxd  rax, dword ptr [rax+32D44h]; 取得索引
.text:0000000000466B0B                 imul    rax, 1920h; cube大小
.text:0000000000466B12                 add     rdi, rax
.text:0000000000466B15                 imul    esi, [rdi+10h]
.text:0000000000466B19                 mov     [rbp+nElements], esi

可以发现h->cube数组取值是通过乘法实现的，当索引为-1即h->cubeStackDepth==-1时，

imul rax, 1920h ==> imul 0xffffffff, 1920h

cube数组每项的大小：sizeof(h->cube[0]) == 0x1920

再变换一下

((struct cube)h->cube)-1

相当于h->cube指针向前移动了一个数组值，即0x1920个字节

再来看看struct _t2cCtx的大小

向前移动了，但是((struct cube)h->cube)-1的位置还是在_t2cCtx结构体中，验证一下

继续单步执行到这，索引值得出

继续si

此时

可以发现0x9d3f8 > 0x31880 ，验证也确实还在结构体中。

这样的话，即使是h->cubeStackDepth==-1也不会导致内存访问出错，最多也就是分析错误，被afkdo捕获也就不奇怪了。我们的结果也确实是这样

但是PJ0给的例子中，存在了一个叫做redzone patch的操作，打完patch之后会出现user-after-poison的错误。

就像这样

==96052==ERROR: AddressSanitizer: use-after-poison on address 0x7ffea1a88890 at pc 0x00000069e6e2 bp 0x7ffea1a46bb0 sp 0x7ffea1a46ba8
READ of size 4 at 0x7ffea1a88890 thread T0#0 0x69e6e1 in do_blend_cube afdko/c/public/lib/source/t2cstr/t2cstr.c:1057:58#1 0x6855fd in t2Decode afdko/c/public/lib/source/t2cstr/t2cstr.c:1857:38#2 0x670a5b in t2cParse afdko/c/public/lib/source/t2cstr/t2cstr.c:2591:18#3 0x542960 in readGlyph afdko/c/public/lib/source/cffread/cffread.c:2927:14#4 0x541c32 in cfrIterateGlyphs afdko/c/public/lib/source/cffread/cffread.c:2966:9#5 0x509662 in cfrReadFont afdko/c/tx/source/tx.c:151:18#6 0x508cc3 in doFile afdko/c/tx/source/tx.c:429:17#7 0x506b2e in doSingleFileSet afdko/c/tx/source/tx.c:488:5#8 0x4fc91e in parseArgs afdko/c/tx/source/tx.c:558:17#9 0x4f9470 in main afdko/c/tx/source/tx.c:1631:9#10 0x7fa93072e2b0 in __libc_start_main#11 0x41e5b9 in _start如果我们想这样的话，该怎么

做呢？

很遗憾，关于手动设置redzone的资料特别少，中文基本上就是纯空白了。而且我发现，基本上这个方法就是PJ0自己成员在用，其他人很少有使用过的。

为了实现这个功能，我把sanitizer的实现资料和相关redzone的源码全部简单过了一遍，最后弄懂了redzone的相关定义和用法，这部分想要了解的话，自己查资料吧，内容比较多，可以重点看一下PJ0介绍sanitizer的几个paper。

最后在sanitizer/asan_interface.h中看到了这部分代码

//===-- sanitizer/asan_interface.h ------------------------------*- C++ -*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file is a part of AddressSanitizer (ASan).
//
// Public interface header.
//===----------------------------------------------------------------------===//
#ifndef SANITIZER_ASAN_INTERFACE_H
#define SANITIZER_ASAN_INTERFACE_H#include <sanitizer/common_interface_defs.h>#ifdef __cplusplus
extern "C" {
#endif
/// Marks a memory region (<c>[addr, addr+size)</c>) as unaddressable.
///
/// This memory must be previously allocated by your program. Instrumented
/// code is forbidden from accessing addresses in this region until it is
/// unpoisoned. This function is not guaranteed to poison the entire region -
/// it could poison only a subregion of <c>[addr, addr+size)</c> due to ASan
/// alignment restrictions.
///
/// \note This function is not thread-safe because no two threads can poison or
/// unpoison memory in the same memory region simultaneously.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
void __asan_poison_memory_region(void const volatile *addr, size_t size);/// Marks a memory region (<c>[addr, addr+size)</c>) as addressable.
///
/// This memory must be previously allocated by your program. Accessing
/// addresses in this region is allowed until this region is poisoned again.
/// This function could unpoison a super-region of <c>[addr, addr+size)</c> due
/// to ASan alignment restrictions.
///
/// \note This function is not thread-safe because no two threads can
/// poison or unpoison memory in the same memory region simultaneously.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
void __asan_unpoison_memory_region(void const volatile *addr, size_t size);// Macros provided for convenience.
#if __has_feature(address_sanitizer) || defined(__SANITIZE_ADDRESS__)
/// Marks a memory region as unaddressable.
///
/// \note Macro provided for convenience; defined as a no-op if ASan is not
/// enabled.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
#define ASAN_POISON_MEMORY_REGION(addr, size) \__asan_poison_memory_region((addr), (size))/// Marks a memory region as addressable.
///
/// \note Macro provided for convenience; defined as a no-op if ASan is not
/// enabled.
///
/// \param addr Start of memory region.
/// \param size Size of memory region.
#define ASAN_UNPOISON_MEMORY_REGION(addr, size) \__asan_unpoison_memory_region((addr), (size))
#else
#define ASAN_POISON_MEMORY_REGION(addr, size) \((void)(addr), (void)(size))
#define ASAN_UNPOISON_MEMORY_REGION(addr, size) \((void)(addr), (void)(size))
#endif

宏定义ASAN_UNPOISON_MEMORY_REGION指向__asan_poison_memory_region，利用这个函数可以设置redzone，之后利用__asan_unpoison_memory_region解除设置PHP大马

方法找到了，那就来看具体代码，设置redzone，在do_blend_cube函数中

/* Execute "blend" op. Return 0 on success else error code. */
static int do_blend_cube(t2cCtx h, int nBlends) {int i;__asan_poison_memory_region(h->cube-1, sizeof(struct _t2cCtx)); // 设置redzoneint nElements = nBlends * h->cube[h->cubeStackDepth].nMasters;int iBase = h->stack.cnt - nElements;int k = iBase + nBlends;if (h->cube[h->cubeStackDepth].nMasters <= 1)return t2cErrInvalidWV;CHKUFLOW(h, nElements);if (h->flags & FLATTEN_CUBE) {for (i = 0; i < nBlends; i++) {int j;double x = INDEX(iBase + i);for (j = 1; j < h->cube[h->cubeStackDepth].nMasters; j++)x += INDEX(k++) * h->cube[h->cubeStackDepth].WV[j];INDEX(iBase + i) = (float)x;}} else {float blendVals[kMaxCubeMasters * kMaxBlendOps];for (i = 0; i < nElements; i++) {blendVals[i] = INDEX(iBase + i);}callback_blend_cube(h, nBlends, nElements, blendVals);}h->stack.cnt = iBase + nBlends;__asan_unpoison_memory_region(h->cube-1, sizeof(struct _t2cCtx)); // 解除redzonereturn 0;
}

这里有一点需要注意，poison的size一定要设置的够大，否则会没有poison的效果，我这里是取_t2cCtx结构体的大小，这样就保证了怎么移动我们都能检测到

来看一下效果

fuzzing 代码

还是这么写main函数

/* Main program. */
int CTL_CDECL main(int argc, char *argv[]) {txCtx h;char *progname;/* Get program name */progname = tail(argv[0]);--argc;++argv;/* Allocate program context */h = malloc(sizeof(struct txCtx_));if (h == NULL) {fprintf(stderr, "%s: out of memory\n", progname);return EXIT_FAILURE;}memset(h, 0, sizeof(struct txCtx_));h->app = APP_TX;h->appSpecificInfo = NULL; /* unused in tx.c, used in rotateFont.c & mergeFonts.c */h->appSpecificFree = txFree;txNew(h, progname);h->t1r.flags = 0; /* I initialize these here,as I need to set the std Encoding flags before calling setMode. */h->cfr.flags = 0;h->cfw.flags = 0;h->dcf.flags = DCF_AllTables | DCF_BreakFlowed;h->dcf.level = 5;h->svr.flags = 0;h->ufr.flags = 0;h->ufow.flags = 0;h->t1w.options = 0;// 设置cff模式setMode(h, mode_cff);// argv[1] 文件名，对应上面argv--doSingleFileSet(h, argv[0]);if (h->failmem.iFail == FAIL_REPORT) {fflush(stdout);fprintf(stderr, "mem_manage() called %ld times in this run.\n",h->failmem.iCall);}txFree(h);return 0;
}

出现异常利用上面的测试一下即可。ASP大马

fuzz代码我公开了，测出有效洞可得找我哈 : )

还不会的话，只能看我的具体项目了，一起学习fuzz哈