Multiple nullptr reads in mdmp.c

[m4drat]

Hi! We've been fuzzing your project and found the following errors in librz/bin/format/mdmp/mdmp.c

Work environment

OS: Ubuntu 20.04
File format: -
rizin version: 4b38597

Bug description

1. Nullptr read in mdmp.c:82, Crash file: crash-0a4b90615b8dd830e86ef1c4e5e80ea9.zip

2. Nullptr read in mdmp.c:91:25, Crash file: crash-71087187fb883c4a4d92b11c8663d47a.zip

Steps to reproduce

1. Build docker container from https://github.com/ispras/oss-sydr-fuzz/tree/master/projects/rizin: sudo docker build -t oss-sydr-fuzz-rizin .

2. Run docker container: sudo docker run --privileged --network host -v /etc/localtime:/etc/localtime:ro --rm -it -v $PWD:/fuzz oss-sydr-fuzz-rizin /bin/bash

3. Execute rizin with crashing input (1):
   /rizin-fuzzing/libfuzzer-asan/bin/rizin -qq crash-0a4b90615b8dd830e86ef1c4e5e80ea9

4. You will see the following output:

   WARNING: Invalid or unsupported enumeration encountered 21
   WARNING: Invalid or unsupported enumeration encountered 22
   ERROR: File is not PE
   WARNING: rz_list_join: assertion 'list1 && list2' failed (line 210)
   WARNING: Pe32_rz_bin_pe_get_exports: assertion 'bin' failed (line 163)
   WARNING: Parsing data sections for large dumps can take time, please be patient (if strings are not needed, try with -z)!
   AddressSanitizer:DEADLYSIGNAL
   =================================================================
   ==2534310==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000e8 (pc 0x000000c65449 bp 0x0c060004ba52 sp 0x7ffc499f84f0 T0)
   ==2534310==The signal is caused by a READ memory access.
   ==2534310==Hint: address points to the zero page.
       #0 0xc65449 in rz_bin_mdmp_free_pe32_bin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/mdmp/mdmp.c:82:25
       #1 0x4fcf7a in rz_list_delete /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:166:3
       #2 0x4fcf7a in rz_list_purge /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:126:3
       #3 0x4fcf7a in rz_list_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:139:3
       #4 0xc64f80 in rz_bin_mdmp_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/mdmp/mdmp.c:120:2
       #5 0xad72fb in rz_bin_file_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bfile.c:57:3
       #6 0x4fcf7a in rz_list_delete /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:166:3
       #7 0x4fcf7a in rz_list_purge /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:126:3
       #8 0x4fcf7a in rz_list_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/util/list.c:139:3
       #9 0xadffdd in rz_bin_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/bin.c:449:2
       #10 0x10254a9 in rz_core_fini /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/core.c:2658:2
       #11 0x1025b48 in rz_core_free /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/core/core.c:2684:2
       #12 0x5b6ac6 in rz_main_rizin /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/main/rizin.c:1503:2
       #13 0x7f56eaf2a082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
       #14 0x41da3d in _start (/home/madrat/Desktop/rizin-report/rz-installation-asan/bin/rizin+0x41da3d)
   
   AddressSanitizer can not provide additional info.
   SUMMARY: AddressSanitizer: SEGV /home/madrat/Desktop/rizin-report/rizin/build-asan/../librz/bin/format/mdmp/mdmp.c:82:25 in rz_bin_mdmp_free_pe32_bin
   ==2534310==ABORTING
   

5. Running rizin with remaining crash-file also results in nullptr deref.