A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command adf has no or wrong argument, anal_fcn_data (core, input + 1) –> RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, core->offset, -1); returns null pointer for fcn causing segmentation fault later in ensure_fcn_range (fcn).
Weakness
The product uses or accesses a resource that has not been initialized.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Radare2 | Radare | * | 4.4.0 (excluding) |
| Radare2 | Ubuntu | bionic | * |
| Radare2 | Ubuntu | esm-apps/bionic | * |
| Radare2 | Ubuntu | esm-apps/focal | * |
| Radare2 | Ubuntu | esm-apps/xenial | * |
| Radare2 | Ubuntu | focal | * |
| Radare2 | Ubuntu | lunar | * |
| Radare2 | Ubuntu | trusty | * |
| Radare2 | Ubuntu | upstream | * |
| Radare2 | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/radareorg/radare2/commit/4d3811681a80f92a53e795f6a64c4b0fc2c8dd22
- https://github.com/radareorg/radare2/issues/16215
- https://github.com/radareorg/radare2/pull/16230
- https://github.com/radareorg/radare2/commit/4d3811681a80f92a53e795f6a64c4b0fc2c8dd22
- https://github.com/radareorg/radare2/issues/16215
- https://github.com/radareorg/radare2/pull/16230