Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

AddressSanitizer: heap-buffer-overflow /home/eack/libsass/src/prelexer.hpp:69:14 in Sass::Prelexer::parenthese_scope(char const*) #2814

Closed
E4ck opened this issue Jan 14, 2019 · 2 comments
Closed

AddressSanitizer: heap-buffer-overflow /home/eack/libsass/src/prelexer.hpp:69:14 in Sass::Prelexer::parenthese_scope(char const*) #2814

E4ck opened this issue Jan 14, 2019 · 2 comments
Labels
Fuzzy

Comments

@E4ck
Copy link

E4ck commented Jan 14, 2019 •
edited
Loading

A heap-buffer-overflow in prelexer.hpp:70:14 in Sass::Prelexer::parenthese_scope(char const*)

Compile and reproduce:
CC=afl-clang-fast CXX=afl-clang-fast++ AFL_USE_ASAN=1 make -C sassc -j4

ldd:

$ ldd sassc
	linux-vdso.so.1 =>  (0x00007fffc6365000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f731150d000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f7311204000)
	libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f7310e82000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f7310c65000)
	librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f7310a5d000)
	libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f7310847000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f731047d000)
	/lib64/ld-linux-x86-64.so.2 (0x00007f7311711000)

System information:
Linux ubuntu64 4.15.0-29-generic #31~16.04.1-Ubuntu SMP Wed Jul 18 08:54:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Version: libsass-3.5.5、sassc-3.4.8

Poc: crash27.zip

Run: cat crash27 | ./sassc

ASAN:

=================================================================
==3211==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000019ac at pc 0x000000949dfd bp 0x7ffcd8af8180 sp 0x7ffcd8af8178
READ of size 1 at 0x6030000019ac thread T0
    #0 0x949dfc in Sass::Prelexer::parenthese_scope(char const*) /home/eack/libsass/src/prelexer.hpp:69:14
    #1 0x931fd1 in char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:227:20
    #2 0x931fd1 in char const* Sass::Prelexer::alternatives<&(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:205
    #3 0x931fd1 in char const* Sass::Prelexer::alternatives<&Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:212
    #4 0x931fd1 in char const* Sass::Prelexer::alternatives<&Sass::Prelexer::identifier, &Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:212
    #5 0x931fd1 in char const* Sass::Prelexer::alternatives<&(char const* Sass::Prelexer::sequence<&Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*)), &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:212
    #6 0x931fd1 in char const* Sass::Prelexer::alternatives<&Sass::Prelexer::block_comment, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*)), &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:212
    #7 0x931fd1 in char const* Sass::Prelexer::non_greedy<&(char const* Sass::Prelexer::alternatives<&Sass::Prelexer::block_comment, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*)), &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*)), &(char const* Sass::Prelexer::sequence<&(char const* Sass::Prelexer::alternatives<&(char const* Sass::Prelexer::exactly<(char)123>(char const*)), &(char const* Sass::Prelexer::exactly<(char)125>(char const*)), &(char const* Sass::Prelexer::exactly<(char)59>(char const*))>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/lexer.hpp:265
    #8 0x8434a6 in char const* Sass::Parser::peek<&(char const* Sass::Prelexer::non_greedy<&(char const* Sass::Prelexer::alternatives<&Sass::Prelexer::block_comment, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*)), &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &(char const* Sass::Prelexer::sequence<&Sass::Prelexer::parenthese_scope, &Sass::Prelexer::interpolant, &(char const* Sass::Prelexer::optional<&Sass::Prelexer::quoted_string>(char const*))>(char const*))>(char const*)), &(char const* Sass::Prelexer::sequence<&(char const* Sass::Prelexer::alternatives<&(char const* Sass::Prelexer::exactly<(char)123>(char const*)), &(char const* Sass::Prelexer::exactly<(char)125>(char const*)), &(char const* Sass::Prelexer::exactly<(char)59>(char const*))>(char const*))>(char const*))>(char const*))>(char const*) /home/eack/libsass/src/parser.hpp:136:27
    #9 0x8434a6 in Sass::Parser::lookahead_for_value(char const*) /home/eack/libsass/src/parser.cpp:2862
    #10 0x7fedcc in Sass::Parser::parse_assignment() /home/eack/libsass/src/parser.cpp:503:27
    #11 0x7f5638 in Sass::Parser::parse_block_node(bool) /home/eack/libsass/src/parser.cpp:229:49
    #12 0x7eee86 in Sass::Parser::parse_block_nodes(bool) /home/eack/libsass/src/parser.cpp:197:11
    #13 0x7ea18f in Sass::Parser::parse() /home/eack/libsass/src/parser.cpp:123:5
    #14 0x611d5b in Sass::Context::register_resource(Sass::Include const&, Sass::Resource const&) /home/eack/libsass/src/context.cpp:324:24
    #15 0x62e930 in Sass::Data_Context::parse() /home/eack/libsass/src/context.cpp:636:5
    #16 0x5b9926 in Sass::sass_parse_block(Sass_Compiler*) /home/eack/libsass/src/sass_context.cpp:234:31
    #17 0x5b9926 in sass_compiler_parse /home/eack/libsass/src/sass_context.cpp:483
    #18 0x5b85c2 in sass_compile_context(Sass_Context*, Sass::Context*) /home/eack/libsass/src/sass_context.cpp:371:7
    #19 0x5b81ac in sass_compile_data_context /home/eack/libsass/src/sass_context.cpp:456:12
    #20 0x5a7069 in compile_stdin /home/eack/sassc/sassc.c:138:5
    #21 0x5a81ed in main /home/eack/sassc/sassc.c:375:18
    #22 0x7f6362d7882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #23 0x4aad88 in _start (/home/eack/sassc/bin/sassc+0x4aad88)

0x6030000019ac is located 0 bytes to the right of 28-byte region [0x603000001990,0x6030000019ac)
allocated by thread T0 here:
    #0 0x56f420 in realloc /home/eack/llvm-install/llvm-6.0.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:107
    #1 0x5a6f22 in compile_stdin /home/eack/sassc/sassc.c:112:25
    #2 0x5a81ed in main /home/eack/sassc/sassc.c:375:18
    #3 0x7f6362d7882f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/eack/libsass/src/prelexer.hpp:69:14 in Sass::Prelexer::parenthese_scope(char const*)
Shadow bytes around the buggy address:
  0x0c067fff82e0: 07 fa fa fa 00 00 00 fa fa fa 00 00 06 fa fa fa
  0x0c067fff82f0: 00 00 04 fa fa fa 00 00 07 fa fa fa 00 00 00 fa
  0x0c067fff8300: fa fa 00 00 06 fa fa fa 00 00 04 fa fa fa 00 00
  0x0c067fff8310: 07 fa fa fa 00 00 00 fa fa fa 00 00 06 fa fa fa
  0x0c067fff8320: 00 00 04 fa fa fa 00 00 07 fa fa fa 00 00 00 fa
=>0x0c067fff8330: fa fa 00 00 00[04]fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8340: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c067fff8350: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x0c067fff8360: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c067fff8370: fd fa fa fa fd fd fd fa fa fa fd fd fd fd fa fa
  0x0c067fff8380: 00 00 00 03 fa fa 00 00 00 03 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3211==ABORTING
@E4ck E4ck changed the title AddressSanitizer: heap-buffer-overflow /home/user/libsass/src/prelexer.hpp:70:14 in Sass::Prelexer::parenthese_scope(char const*) AddressSanitizer: heap-buffer-overflow /home/eack/libsass/src/prelexer.hpp:69:14 in Sass::Prelexer::parenthese_scope(char const*) Jan 14, 2019
@fgeek
Copy link

fgeek commented Jan 20, 2019

CVE-2019-6283 has been assigned for this vulnerability

glebm added a commit to glebm/libsass that referenced this issue Apr 4, 2019
@glebm
Fix heap-buffer-overflow in prelexer.hpp:70
a865173 
Fixes sass#2814
@glebm glebm mentioned this issue Apr 4, 2019
Closed
glebm added a commit to glebm/libsass that referenced this issue Apr 4, 2019
@glebm
Fix heap-buffer-overflow in prelexer.hpp:70
0f3d3f8 
Fixes sass#2814
@glebm glebm mentioned this issue Apr 4, 2019
Merged
xzyfer pushed a commit that referenced this issue Apr 5, 2019
@glebm @xzyfer
Fix heap-buffer-overflow in prelexer.hpp:70 (#2857)
8e681e2 
Fixes #2814
@glebm glebm added the Fuzzy label Apr 15, 2019
@mehagar
Copy link

mehagar commented Jun 20, 2020 •
edited
Loading

Should the CVE be marked as fixed for this: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6283?

I noticed because snyk was showing this as not having any fixed versions: https://snyk.io/vuln/SNYK-JS-NODESASS-535498

@Abdul1110 Abdul1110 mentioned this issue May 12, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Fuzzy
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@glebm @fgeek @mehagar @E4ck