Fix integer overflow in fuzzed dwarf rendering in graphs ##crash

* Reported by @solid-snail via huntrdev * BountyID: c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2/ * Reproducer: `intof_mod`
radareorg · Dec 1, 2022 · b53a158 · b53a158 · solid-snail · Dec 1, 2022
1 parent 7ef58be
commit b53a158
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/dist/docker/Dockerfile b/dist/docker/Dockerfile
@@ -70,6 +70,9 @@ RUN DEBIAN_FRONTEND=noninteractive dpkg --add-architecture i386 && \
   bison \
   pkg-config \
   make \
+  python3 \
+  python3-pip \
+  sudo \
   glib-2.0 \
   libc6:i386 \
   libncurses5:i386 \

diff --git a/libr/core/canal.c b/libr/core/canal.c
@@ -1390,6 +1390,10 @@ static char *core_anal_graph_label(RCore *core, RAnalBlock *bb, int opts) {
 				filestr = r_file_slurp_line (file, line, 0);
 				if (filestr) {
 					int flen = strlen (filestr);
+					if (idx < 0 || ST32_ADD_OVFCHK (idx, flen + 8)) {
+						R_LOG_WARN ("integer overflow detected");
+						break;
+					}
 					cmdstr = realloc (cmdstr, idx + flen + 8);
 					memcpy (cmdstr + idx, filestr, flen);
 					idx += flen;