Bug: heap-buffer-overflow in lib_tparm.c

[puppet]

Version:  ncurses 6.2.20200212
OS: Ubuntu 16.04 LTS
POC: https://github.com/puppet-meteor/NLP_POC/blob/master/infotocap/POC_4_000017
a similar POC: https://github.com/puppet-meteor/NLP_POC/blob/master/infotocap/POC_11_000057
cmd: ./infotocap POC
ASAN log:

==34710==WARNING: unexpected format specifier in printf interceptor: %#########################################.#
=================================================================
==34710==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ef76 at pc 0x7ffff6ecb9f5 bp 0x7ffffffea7e0 sp 0x7ffffffe9f70
WRITE of size 25 at 0x60200000ef76 thread T0
    #0 0x7ffff6ecb9f4 in __interceptor_vsprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x619f4)
    #1 0x7ffff6ecbcc9 in __interceptor_sprintf (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x61cc9)
    #2 0x42bcb8 in save_text ../../ncurses/tinfo/lib_tparm.c:146
    #3 0x42dc25 in tparam_internal ../../ncurses/tinfo/lib_tparm.c:615
    #4 0x42eccb in tparm ../../ncurses/tinfo/lib_tparm.c:854
    #5 0x435539 in set_attribute_9 ../../ncurses/tinfo/trim_sgr0.c:55
    #6 0x4360bd in _nc_trim_sgr0 ../../ncurses/tinfo/trim_sgr0.c:245
    #7 0x41b343 in fmt_entry ../../progs/dump_entry.c:1082
    #8 0x41da5c in dump_entry ../../progs/dump_entry.c:1542
    #9 0x405e5e in main ../../progs/tic.c:1041
    #10 0x7ffff6ac082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x4024e8 in _start (/data3/ASAN/ncurses-6.2/ASAN/infotocap+0x4024e8)

0x60200000ef76 is located 0 bytes to the right of 6-byte region [0x60200000ef70,0x60200000ef76)
allocated by thread T0 here:
    #0 0x7ffff6f02961 in realloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)
    #1 0x425cbf in _nc_doalloc ../../ncurses/tinfo/doalloc.c:51
    #2 0x42bbb6 in get_space ../../ncurses/tinfo/lib_tparm.c:133
    #3 0x42be63 in save_char ../../ncurses/tinfo/lib_tparm.c:171
    #4 0x42da78 in tparam_internal ../../ncurses/tinfo/lib_tparm.c:574
    #5 0x42eccb in tparm ../../ncurses/tinfo/lib_tparm.c:854
    #6 0x435539 in set_attribute_9 ../../ncurses/tinfo/trim_sgr0.c:55
    #7 0x4360bd in _nc_trim_sgr0 ../../ncurses/tinfo/trim_sgr0.c:245
    #8 0x41b343 in fmt_entry ../../progs/dump_entry.c:1082
    #9 0x41da5c in dump_entry ../../progs/dump_entry.c:1542
    #10 0x405e5e in main ../../progs/tic.c:1041
    #11 0x7ffff6ac082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __interceptor_vsprintf
Shadow bytes around the buggy address:
  0x0c047fff9d90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c047fff9de0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa[06]fa
  0x0c047fff9df0: fa fa fd fa fa fa 00 04 fa fa fd fa fa fa 00 07
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==34710==ABORTING

	



From ZJU NESA Lab