program crash

[E4ck]

A crash in libsass-3.6.2/src/memory/SharedPtr.hpp:116:53 in Sass::SharedPtr::SharedPtr(Sass::SharedPtr const&)

Compile and reproduce:
CC=afl-clang-fast CXX=afl-clang-fast++ AFL_USE_ASAN=1 make -C sassc -j4

Version: libsass-3.6.2、sassc-3.6.1

Poc: 0.zip

Run: cat 0 | ./sassc

ASAN:

=================================================================
==21782==ERROR: AddressSanitizer: SEGV on unknown address 0x3fffffff (pc 0x0867c9cb bp 0xbf99a6e8 sp 0xbf99a1e0 T0)
==21782==The signal is caused by a READ memory access.
    #0 0x867c9ca in Sass::SharedPtr::SharedPtr(Sass::SharedPtr const&) /home/eack/libsass-3.6.2/src/memory/SharedPtr.hpp:116:53
    #1 0x867c9ca in Sass::SharedImpl<Sass::SimpleSelector>::SharedImpl(Sass::SharedImpl<Sass::SimpleSelector> const&) /home/eack/libsass-3.6.2/src/memory/SharedPtr.hpp:183:9
    #2 0x867c9ca in Sass::Parser::parseCompoundSelector() /home/eack/libsass-3.6.2/src/parser_selectors.cpp:143:34
    #3 0x8679337 in Sass::Parser::parseComplexSelector(bool) /home/eack/libsass-3.6.2/src/parser_selectors.cpp:42:47
    #4 0x86822b2 in Sass::Parser::parseSelectorList(bool) /home/eack/libsass-3.6.2/src/parser_selectors.cpp:82:36
    #5 0x84f300d in Sass::Parser::parse_ruleset(Lookahead) /home/eack/libsass-3.6.2/src/parser.cpp:530:25
    #6 0x84b648c in Sass::Parser::parse_block_node(bool) /home/eack/libsass-3.6.2/src/parser.cpp:278:21
    #7 0x84a90f7 in Sass::Parser::parse_block_nodes(bool) /home/eack/libsass-3.6.2/src/parser.cpp:189:11
    #8 0x84a5cba in Sass::Parser::parse() /home/eack/libsass-3.6.2/src/parser.cpp:115:5
    #9 0x82885ba in Sass::Context::register_resource(Sass::Include const&, Sass::Resource const&) /home/eack/libsass-3.6.2/src/context.cpp:306:24
    #10 0x82a0868 in Sass::Data_Context::parse() /home/eack/libsass-3.6.2/src/context.cpp:618:5
    #11 0x823eb26 in Sass::sass_parse_block(Sass_Compiler*) /home/eack/libsass-3.6.2/src/sass_context.cpp:180:31
    #12 0x823eb26 in sass_compiler_parse /home/eack/libsass-3.6.2/src/sass_context.cpp:434:22
    #13 0x823dd32 in sass_compile_context(Sass_Context*, Sass::Context*) /home/eack/libsass-3.6.2/src/sass_context.cpp:317:7
    #14 0x823d998 in sass_compile_data_context /home/eack/libsass-3.6.2/src/sass_context.cpp:407:12
    #15 0x822e1e0 in compile_stdin /home/eack/sassc-3.6.1/sassc.c:138:5
    #16 0x822f9fc in main /home/eack/sassc-3.6.1/sassc.c:375:18
    #17 0xb7b87636 in __libc_start_main /build/glibc-GoSbp4/glibc-2.23/csu/../csu/libc-start.c:291
    #18 0x8185547 in _start (/home/eack/sassc-3.6.1/bin/sassc+0x8185547)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/eack/libsass-3.6.2/src/memory/SharedPtr.hpp:116:53 in Sass::SharedPtr::SharedPtr(Sass::SharedPtr const&)
==21782==ABORTING

Valgrind:

==8007== Memcheck, a memory error detector
==8007== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==8007== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==8007== Command: ./sassc_org /home/eack/dj_crashes/0
==8007== 
==8007== Invalid read of size 4
==8007==    at 0x828F490: SharedPtr (SharedPtr.hpp:116)
==8007==    by 0x828F490: SharedImpl (SharedPtr.hpp:183)
==8007==    by 0x828F490: Sass::Parser::parseCompoundSelector() (parser_selectors.cpp:143)
==8007==    by 0x828E3A1: Sass::Parser::parseComplexSelector(bool) (parser_selectors.cpp:42)
==8007==    by 0x8291E3C: Sass::Parser::parseSelectorList(bool) (parser_selectors.cpp:82)
==8007==    by 0x8200C14: Sass::Parser::parse_ruleset(Lookahead) (parser.cpp:530)
==8007==    by 0x81ED946: Sass::Parser::parse_block_node(bool) (parser.cpp:278)
==8007==    by 0x81E7908: Sass::Parser::parse_block_nodes(bool) (parser.cpp:189)
==8007==    by 0x81E5DC8: Sass::Parser::parse() (parser.cpp:115)
==8007==    by 0x80D4BD1: Sass::Context::register_resource(Sass::Include const&, Sass::Resource const&) (context.cpp:306)
==8007==    by 0x80DFD8A: Sass::File_Context::parse() (context.cpp:576)
==8007==    by 0x80AC925: sass_parse_block (sass_context.cpp:180)
==8007==    by 0x80AC925: sass_compiler_parse (sass_context.cpp:434)
==8007==    by 0x80AC05E: sass_compile_context(Sass_Context*, Sass::Context*) (sass_context.cpp:317)
==8007==    by 0x80AC301: sass_compile_file_context (sass_context.cpp:421)
==8007==  Address 0xfffffffc is not stack'd, malloc'd or (recently) free'd
==8007== 
==8007== 
==8007== Process terminating with default action of signal 11 (SIGSEGV)
==8007==  Access not within mapped region at address 0xFFFFFFFC
==8007==    at 0x828F490: SharedPtr (SharedPtr.hpp:116)
==8007==    by 0x828F490: SharedImpl (SharedPtr.hpp:183)
==8007==    by 0x828F490: Sass::Parser::parseCompoundSelector() (parser_selectors.cpp:143)
==8007==    by 0x828E3A1: Sass::Parser::parseComplexSelector(bool) (parser_selectors.cpp:42)
==8007==    by 0x8291E3C: Sass::Parser::parseSelectorList(bool) (parser_selectors.cpp:82)
==8007==    by 0x8200C14: Sass::Parser::parse_ruleset(Lookahead) (parser.cpp:530)
==8007==    by 0x81ED946: Sass::Parser::parse_block_node(bool) (parser.cpp:278)
==8007==    by 0x81E7908: Sass::Parser::parse_block_nodes(bool) (parser.cpp:189)
==8007==    by 0x81E5DC8: Sass::Parser::parse() (parser.cpp:115)
==8007==    by 0x80D4BD1: Sass::Context::register_resource(Sass::Include const&, Sass::Resource const&) (context.cpp:306)
==8007==    by 0x80DFD8A: Sass::File_Context::parse() (context.cpp:576)
==8007==    by 0x80AC925: sass_parse_block (sass_context.cpp:180)
==8007==    by 0x80AC925: sass_compiler_parse (sass_context.cpp:434)
==8007==    by 0x80AC05E: sass_compile_context(Sass_Context*, Sass::Context*) (sass_context.cpp:317)
==8007==    by 0x80AC301: sass_compile_file_context (sass_context.cpp:421)
==8007==  If you believe this happened as a result of a stack
==8007==  overflow in your program's main thread (unlikely but
==8007==  possible), you can try to increase the size of the
==8007==  main thread stack using the --main-stacksize= flag.
==8007==  The main thread stack size used in this run was 8388608.
==8007== 
==8007== HEAP SUMMARY:
==8007==     in use at exit: 46,438 bytes in 594 blocks
==8007==   total heap usage: 645 allocs, 51 frees, 54,035 bytes allocated
==8007== 
==8007== LEAK SUMMARY:
==8007==    definitely lost: 0 bytes in 0 blocks
==8007==    indirectly lost: 0 bytes in 0 blocks
==8007==      possibly lost: 0 bytes in 0 blocks
==8007==    still reachable: 46,438 bytes in 594 blocks
==8007==         suppressed: 0 bytes in 0 blocks
==8007== Reachable blocks (those to which a pointer was found) are not shown.
==8007== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==8007== 
==8007== For counts of detected and suppressed errors, rerun with: -v
==8007== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

[mgreter]

Duplicate of #3001