AddressSanitizer: stack-overflow when creating String_Schema_Obj (parser.cpp:1808)

[hongxuchen]

We found with our fuzzer some stack over flow errors when constructing String_Schema_Obj at Line 1808 in parser.cpp (45f5087) when compiled with Address Sanitizer (using sassc as the driver).

ASAN:SIGSEGV
=================================================================
==17368==ERROR: AddressSanitizer: stack-overflow on address 0x7fff100a5b48 (pc 0x7f979147d485 bp 0x7fff100a6390 sp 0x7fff100a5b30 T0)
    #0 0x7f979147d484 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99484)
    #1 0x7f9790f2e592 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1808
    #2 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #3 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #4 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #5 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #6 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #7 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #8 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #9 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #10 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #11 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #12 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #13 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #14 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #15 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #16 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #17 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #18 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #19 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
...
    #248 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #249 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #250 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #251 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835

SUMMARY: AddressSanitizer: stack-overflow ??:0 operator new(unsigned long)
==17368==ABORTING

sample inputs:
test_s101.txt
test_s203.txt
test_s205.txt
test_s402.txt

[hongxuchen]

Other relevant input files (some of them emit different different call stacks in different runs):
so_parser.cpp:1808_01.txt
so_parser.cpp:1792_01.txt
so_parser.cpp:1792_02.txt
so_parser.cpp:1846_01.txt

[glebm]

Still broken on master

[glebm]

Minimal repro:

echo "a{--b:$(printf '[%.0s' {1..2800})" | sassc/bin/sassc

[xi]

Assigned CVE-2018-20821