Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

stack-overflow on ass_parse.c:234 *parse_tag #422

Closed
Fstark-prog opened this issue Aug 27, 2020 · 5 comments
Closed

stack-overflow on ass_parse.c:234 *parse_tag #422

Fstark-prog opened this issue Aug 27, 2020 · 5 comments

Comments

@Fstark-prog
Copy link

Fstark-prog commented Aug 27, 2020

Description
A vulnerability was found in function parse_tag in ass_parse.c:234 ,which allow attackers to cause a denial of service or remote code execution via a crafted file.

test@test:~/libass-0.14.0/afl$ ./a.out crash/poc
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
./a.out < INPUT_FILE
or
./a.out INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
afl-fuzz [afl-flags] ./a.out [-N]

afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================

Reading 50635 bytes from crash/poc

ASAN:DEADLYSIGNAL
=================================================================

==64283==ERROR: AddressSanitizer: stack-overflow on address 0x7fff99b2bff8 (pc 0x00000046724b bp 0x7fff99b2fcf0 sp 0x7fff99b2c000 T0)
    #0 0x46724a in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:234
    #1 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #2 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #3 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #4 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #5 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #6 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #7 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #8 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #9 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #10 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #11 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #12 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #13 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #14 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #15 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #16 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #17 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #18 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #19 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #20 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #21 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #22 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #23 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #24 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #25 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #26 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #27 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #28 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #29 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #30 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #31 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #32 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #33 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #34 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #35 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #36 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #37 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #38 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #39 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #40 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #41 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #42 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #43 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #44 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #45 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #46 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #47 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #48 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #49 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #50 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #51 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #52 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #53 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #54 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #55 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #56 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #57 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #58 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #59 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #60 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #61 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #62 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #63 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #64 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #65 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #66 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #67 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #68 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #69 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #70 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #71 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #72 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #73 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #74 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #75 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #76 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #77 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #78 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #79 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #80 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #81 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #82 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #83 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #84 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #85 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #86 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #87 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #88 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #89 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #90 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #91 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #92 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #93 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #94 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #95 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #96 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #97 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #98 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #99 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #100 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #101 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #102 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #103 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #104 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #105 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #106 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #107 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #108 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #109 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #110 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #111 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #112 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #113 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #114 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #115 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #116 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #117 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #118 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #119 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #120 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #121 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #122 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #123 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #124 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #125 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #126 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #127 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #128 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #129 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #130 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #131 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #132 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #133 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #134 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #135 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #136 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #137 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #138 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #139 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #140 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #141 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #142 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #143 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #144 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #145 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #146 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #147 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #148 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #149 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #150 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #151 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #152 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #153 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #154 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #155 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #156 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #157 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #158 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #159 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #160 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #161 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #162 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #163 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #164 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #165 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #166 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #167 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #168 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #169 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #170 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #171 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #172 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #173 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #174 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #175 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #176 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #177 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #178 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #179 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #180 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #181 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #182 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #183 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #184 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #185 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #186 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #187 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #188 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #189 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #190 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #191 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #192 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #193 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #194 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #195 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #196 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #197 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #198 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #199 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #200 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #201 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #202 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #203 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #204 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #205 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #206 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #207 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #208 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #209 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #210 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #211 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #212 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #213 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #214 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #215 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #216 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #217 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #218 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #219 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #220 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #221 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #222 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #223 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #224 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #225 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #226 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #227 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #228 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #229 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #230 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #231 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #232 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #233 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #234 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #235 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #236 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #237 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #238 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #239 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #240 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #241 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #242 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #243 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #244 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #245 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #246 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #247 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #248 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #249 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #250 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654

SUMMARY: AddressSanitizer: stack-overflow /home/test/libass-0.14.0/libass/ass_parse.c:234 in parse_tag
==64283==ABORTING
@astiob
Copy link
Member

astiob commented Aug 27, 2020

I believe this is already fixed in the master branch (ironically, in one of the very first commits after the 0.14.0 release that you’re testing, namely 6835731, part of #296). Could you confirm this by building your libass from master?

We do need to make a new release though.

@stevebeattie
Copy link

This issue was assigned CVE-2020-24994.

@TheOneric
Copy link
Member

@stevebeattie: Hi, thanks for letting us know. I believe the description of this CVE is wrong; it states (emphasis mine): “Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.14.0”, but 6835731 only landed after 0.14.0 was released.

@stevebeattie
Copy link

@TheOneric thanks, I've submitted correction information to MITRE, we'll see how long it takes them to update it.

(In an ideal world, you'd be able to file a github issue directly against https://github.com/CVEProject/cvelist but they don't allow bug reports on the project.)

@stevebeattie
Copy link

FYI, CVE-2020-24994 has corrected information. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants