[crash] segfault / out-of-bounds read in WasmBinaryBuilder::readImports

[pventuzelo]

Hi,

During fuzzing I found this vulnerability inside binaryen WasmBinaryBuilder.
Based on quick analysis using GDB and valgrind, it seems to be an Out-of-bounds Read vulnerability (CWE-125).

Bug can be triggered using wasm-opt or wasm-dis.

Reproduce

Binaryen commit: 6d49741

Download: segfault_binaryen_oob_read.zip

$ ./wasm-opt segfault_binaryen_oob_read.wasm 
[1]    31858 segmentation fault  ./wasm-opt segfault_binaryen_oob_read.wasm

GDB

$ gdb --args ./wasm-opt segfault_binaryen_oob_read.wasm
GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...

Reading symbols from ./wasm-opt...(no debugging symbols found)...done.
(gdb) r
Starting program: /home/scop/Documents/webassembly/binaryen/bin/wasm-opt segfault_binaryen_oob_read.wasm
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000555555a9a02f in wasm::WasmBinaryBuilder::readImports() ()
(gdb) bt
#0  0x0000555555a9a02f in wasm::WasmBinaryBuilder::readImports() ()
#1  0x0000555555a9f918 in wasm::WasmBinaryBuilder::read() ()
#2  0x0000555555acd498 in wasm::ModuleReader::readBinaryData(std::vector<char, std::allocator<char> >&, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) ()
#3  0x0000555555acd921 in wasm::ModuleReader::readBinary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) ()
#4  0x0000555555ace788 in wasm::ModuleReader::read(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) ()
#5  0x000055555573ead2 in main ()

Valgrind

$ valgrind ./wasm-opt segfault_binaryen_oob_read.wasm
==1356== Memcheck, a memory error detector
==1356== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1356== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==1356== Command: ./wasm-opt segfault_binaryen_oob_read.wasm
==1356== 
==1356== Invalid read of size 8
==1356==    at 0x64E02F: wasm::WasmBinaryBuilder::readImports() (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x653917: wasm::WasmBinaryBuilder::read() (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x681497: wasm::ModuleReader::readBinaryData(std::vector<char, std::allocator<char> >&, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x681920: wasm::ModuleReader::readBinary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x682787: wasm::ModuleReader::read(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x2F2AD1: main (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==1356== 
==1356== 
==1356== Process terminating with default action of signal 11 (SIGSEGV)
==1356==  Access not within mapped region at address 0x0
==1356==    at 0x64E02F: wasm::WasmBinaryBuilder::readImports() (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x653917: wasm::WasmBinaryBuilder::read() (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x681497: wasm::ModuleReader::readBinaryData(std::vector<char, std::allocator<char> >&, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x681920: wasm::ModuleReader::readBinary(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x682787: wasm::ModuleReader::read(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, wasm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >) (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==    by 0x2F2AD1: main (in /home/scop/Documents/webassembly/binaryen/bin/wasm-opt)
==1356==  If you believe this happened as a result of a stack
==1356==  overflow in your program's main thread (unlikely but
==1356==  possible), you can try to increase the size of the
==1356==  main thread stack using the --main-stacksize= flag.
==1356==  The main thread stack size used in this run was 8388608.
==1356== 
==1356== HEAP SUMMARY:
==1356==     in use at exit: 104,907 bytes in 1,526 blocks
==1356==   total heap usage: 2,416 allocs, 890 frees, 279,260 bytes allocated
==1356== 
==1356== LEAK SUMMARY:
==1356==    definitely lost: 0 bytes in 0 blocks
==1356==    indirectly lost: 0 bytes in 0 blocks
==1356==      possibly lost: 0 bytes in 0 blocks
==1356==    still reachable: 104,907 bytes in 1,526 blocks
==1356==         suppressed: 0 bytes in 0 blocks
==1356== Rerun with --leak-check=full to see details of leaked memory
==1356== 
==1356== For counts of detected and suppressed errors, rerun with: -v
==1356== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
[1]    1356 segmentation fault  valgrind ./wasm-opt segfault_binaryen_oob_read.wasm