Repository navigation
[Security] Signed integer overflow in r_str_replace #26046
Description
This report was generated by AI and manually verified by a human.
Environment
# copypaste this script into your shell and replace it with the output
date
r2 -v
uname -msDescription
r_str_replace in libr/util/str.c can overflow signed int arithmetic while computing the new string length.
The PoC drives the replacement-size calculation so that UBSan reports signed integer overflow at libr/util/str.c:956:9:
runtime error: signed integer overflow: 2147483639 + 31 cannot be represented in type 'int'
The expected behavior is to use checked length arithmetic and reject replacement requests whose computed output size cannot be represented safely.
Test
PoC:
Reproducer:
ROOT="$PWD"
curl -LO https://raw.githubusercontent.com/Bin-infinite/vuln-validations/main/radare2/target/case-028/pocs/r_str_replace_int_overflow_harness.c
clang -fsanitize=address,undefined -fno-omit-frame-pointer -g -O0 \
-I"$ROOT/libr/include" \
-I"$ROOT/build" \
-I"$ROOT/shlr/sdb/include" \
-L"$ROOT/build/libr/util" \
-Wl,-rpath,"$ROOT/build/libr/util" \
-o /tmp/r_str_replace_int_overflow_harness \
r_str_replace_int_overflow_harness.c \
-lr_util
ASAN_OPTIONS=detect_leaks=0 \
UBSAN_OPTIONS=halt_on_error=0:print_stacktrace=1 \
/tmp/r_str_replace_int_overflow_harnessExpected sanitizer result:
libr/util/str.c:956:9: runtime error: signed integer overflow: 2147483639 + 31 cannot be represented in type 'int'
Stack trace excerpt:
#0 r_str_replace libr/util/str.c:956
#1 main row-validation-output/case-028/pocs/r_str_replace_int_overflow_harness.c:50
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior libr/util/str.c:956:9
Activity
trufae commentedon Jun 4, 2026
you are using this function wrong. thats not a bug
trufae commentedon Jun 4, 2026
hardened here but still not a real bug just a hint for hardening really marginal bugs when using this function in a very wrong way #26050
Fix #26046 - Harden and optimie RStr.replace for irreal 2 milion leng…