Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AddressSanitizer: stack-overflow at IMPLEMENT_AST_OPERATORS expansion #2660

Closed
hongxuchen opened this issue Jun 2, 2018 · 6 comments
Closed

Comments

@hongxuchen
Copy link

We found with our fuzzer some stack over flow errors when executing on IMPLEMENT_AST_OPERATORS expansion inside ast.cpp (exact lines may differ in 2163 or 2164 when compiled with different optimizations, 45f5087) when compiled with Address Sanitizer (using sassc as the driver).

ASAN:SIGSEGV
=================================================================
==17364==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe07614ff8 (pc 0x7f79ff50c279 bp 0x0000000000e8 sp 0x7ffe07614ff0 T0)
    #0 0x7f79ff50c278  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xb0278)
    #1 0x7f79ff50bd67  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xafd67)
    #2 0x7f79ff47ef4f  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22f4f)
    #3 0x7f79ff4f54fe in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x994fe)
    #4 0x7f79fedf58ea in Sass::Compound_Selector::copy() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2163
    #5 0x7f79fede080a in Sass::Compound_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2163
    #6 0x7f79fedee303 in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1490
    #7 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #8 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #9 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #10 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #11 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #12 0x7f79fedebda7 in Sass::Selector_List::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1504
    #13 0x7f79fede09b7 in Sass::Selector_List::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2170
...
    #248 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #249 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #250 0x7f79fedebda7 in Sass::Selector_List::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1504
    #251 0x7f79fede09b7 in Sass::Selector_List::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2170

SUMMARY: AddressSanitizer: stack-overflow ??:0 ??
==17364==ABORTING

Sample input files:
test_s201.txt
test_s202.txt
test_s204.txt

@hongxuchen
Copy link
Author

hongxuchen commented Jun 3, 2018

@hongxuchen hongxuchen changed the title Stack over flow errors at IMPLEMENT_AST_OPERATORS expansion AddressSanitizer: stack-overflow at IMPLEMENT_AST_OPERATORS expansion Jun 3, 2018
@xzyfer
Copy link
Contributor

xzyfer commented Jul 4, 2018

Thanks for the report.
We confirmed this issue shares a common root cause to other reported issues.
We have assigned the selector-validation to the affected issues.

@glebm
Copy link
Contributor

glebm commented Nov 25, 2018

The three cases from the original post no longer fail.
All the "Other input files" from #2660 (comment) still fail.

@glebm
Copy link
Contributor

glebm commented Nov 26, 2018

A simple reproduction:

:not(f(x)) {
  color: red;
  @extend x;
}

sassc: Stack Overflow.

dart-sass:

Error: expected ")".
a:not(f(x)){
       ^
  ../../../tmp/so2.scss 1:8  root stylesheet

ruby-sass:

Error: Invalid CSS after "a:not(f": expected ")", was "(x))"
        on line 1 of /home/glebm/tmp/so2.scss
  Use --trace for backtrace.
``

@glebm
Copy link
Contributor

glebm commented Apr 10, 2019

This is fixed on master (not sure by which commit)

@gate5
Copy link

gate5 commented Jun 27, 2019

Can you please explain where is the fix commit? And what is the specific version that contains this fix?

NVD says about the vulnerability CVE-2018-19838: "In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy()." with a reference to this issue #2660.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants