SIGABRT - process aborted

[clod81]

PoC:

require 'yajl'

File.open(ARGV[0]) do |f|
  Yajl::Parser.new.parse(f)
end

File passed as input:
{"e":{"\uD800\\DC00":"a"}}

Output:

ruby: yajl_encode.c:192: void yajl_string_decode(yajl_buf, const unsigned char *, unsigned int): Assertion `"this should never happen" == NULL' failed.

With this input:

{"\uDBFF\\u "@: "

Output:

ruby: yajl_encode.c:108: void hexToDigit(unsigned int *, const unsigned char *): Assertion `!(c & 0xF0)' failed.

[brianmario]

What version of yajl-ruby are you using?

[clod81]

latest available on rubygems, 1.3.0

[carnil]

This has been assigned CVE-2017-16516

[brianmario]

yajl-ruby embeds a patched copy of yajl itself. I was able to reproduce this on my machine issue on the yajl 1.x branch, but curiously only if I enabled debug symbols 🤔

I'm running macOS 10.13.1 and the latest Xcode developer tools.

You should be able to reproduce it by cloning yajl locally, checking out the 1.x branch then building the library like so:

$ cmake -DCMAKE_BUILD_TYPE=Debug
$ make

From there you'll need to build a small C program that links against the library and reads the bad input you specified in this issue.

I'll continue to debug this to try and figure out a fix, but in the meantime I think we should get an issue opened over on the yajl repo itself. What do you think?

[brianmario]

I put up the test program I was using here.

[brianmario]

I was actually able to reproduce this on yajl master as well 😞

Still digging but it seems like it might be that there's no validation that the character following a surrogate pair is in the expected escaped format.

[brianmario]

The smallest reproduction case is "\uD800\\1" where "1" there can literally be any character.

[carnil]

a8ca8f4 seems to address the issue

[clod81]

I ran the new release against the two test cases, and it's looking good. Thanks for the quick turnaround @brianmario 👍

[brianmario]

Of course!

Though next time (but hopefully there is no "next time" haha) let's make sure to disclose vulnerabilities privately first 😉

[clod81]

@brianmario didn't notice your details were on your profile, but ok.

[brianmario]

Oh ok no worries, glad we were able to get it fixed so quickly 😄

[Gaurav28102]

Good job