A NULL pointer dereference in the function yasm_expr__copy_except() libyasm/expr.c:999

[Clingto]

System info:
Ubuntu 16.04.6 LTS, X64, gcc 5.4.0, yasm (latest master 009450c)
Compile Command:

$ ./autogen.sh
make distclean

CC=gcc CXX=g++ CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" ./configure --prefix=$PWD/build --disable-shared
make -j
make install

Run Command:

$ yasm  $POC

POC file:
https://github.com/Clingto/POC/blob/master/MSA/yasm/yasm-1113-yasm_expr__copy_except-null-pointer-deref

ASAN info:

yasm: file name already has no extension: output will be in `yasm.out'
ASAN:SIGSEGV
=================================================================
==10834==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7fdb4c7eafb3 bp 0x7fff7a57d890 sp 0x7fff7a57d840 T0)
    #0 0x7fdb4c7eafb2 in yasm_expr__copy_except  test/yasm-uaf/SRC_asan/libyasm/expr.c:999
    #1 0x7fdb4908fad6 in nasm_parser_directive  test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:1584
    #2 0x7fdb4909bd3c in parse_line  test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:377
    #3 0x7fdb4909bd3c in nasm_parser_parse  test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parse.c:231
    #4 0x7fdb4908f36b in nasm_do_parse  test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:66
    #5 0x7fdb4908f36b in nasm_parser_do_parse  test/yasm-uaf/SRC_asan/modules/parsers/nasm/nasm-parser.c:83
    #6 0x402c84 in do_assemble  test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:521
    #7 0x402c84 in main  test/yasm-uaf/SRC_asan/frontends/yasm/yasm.c:753
    #8 0x7fdb4c21382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x403ee8 in _start ( test/yasm-uaf/bin_asan/bin/yasm+0x403ee8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV  test/yasm-uaf/SRC_asan/libyasm/expr.c:999 yasm_expr__copy_except
==10834==ABORTING

[rathann]

This was assigned CVE-2021-33463 .

[rathann]

After #241, the POC still crashes yasm, but in a different place:

(gdb) bt
#0  yasm_section_bcs_append (bc=0x555555645bd0, sect=0x0) at libyasm/section.c:629
#1  nasm_parser_parse (parser_nasm=0x7fffffffd870) at modules/parsers/nasm/nasm-parse.c:264
#2  nasm_do_parse (object=0x555555640160, pp=<optimized out>, save_input=<optimized out>, linemap=<optimized out>, errwarns=0x55555563fc70, tasm=<optimized out>) at modules/parsers/nasm/nasm-parser.c:66
#3  0x000055555559109d in do_assemble () at frontends/yasm/yasm.c:641
#4  main (argc=<optimized out>, argv=<optimized out>) at frontends/yasm/yasm.c:877