Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV yasm/modules/preprocs/nasm/nasm-pp.c in delete_Token #216

Open
z1r00 opened this issue Mar 31, 2023 · 12 comments
Open

SEGV yasm/modules/preprocs/nasm/nasm-pp.c in delete_Token #216

z1r00 opened this issue Mar 31, 2023 · 12 comments

Comments

@z1r00
Copy link

z1r00 commented Mar 31, 2023

SEGV yasm/modules/preprocs/nasm/nasm-pp.c in delete_Token

project address

https://github.com/yasm/yasm

info

OS:Ubuntu20.04 TLS

Build: ./autogen.sh && make distclean && CC=gcc CXX=g++ CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" ./configure --prefix=$PWD/build --disable-shared && make -j && make install

Poc

https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/id:000176%2Csig:06%2Csrc:008442%2B007750%2Cop:splice%2Crep:128

ASAN Info

./yasm id:000176,sig:06,src:008442+007750,op:splice,rep:128

yasm: file name already has no extension: output will be in `yasm.out'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3784849==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005994b7 bp 0x7ffd44e1e310 sp 0x7ffd44e1de80 T0)
==3784849==The signal is caused by a READ memory access.
==3784849==Hint: address points to the zero page.
    #0 0x5994b7 in delete_Token /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-pp.c
    #1 0x5994b7 in expand_macros_in_string /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-pp.c:2317:16
    #2 0x5994b7 in do_directive /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-pp.c:2873:17
    #3 0x58994f in pp_getline /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-pp.c:5083:13
    #4 0x58291c in nasm_preproc_get_line /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-preproc.c:198:12
    #5 0x578570 in nasm_parser_parse /home/z1r0/fuzzing/yasm/yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #6 0x577618 in nasm_do_parse /home/z1r0/fuzzing/yasm/yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #7 0x577618 in nasm_parser_do_parse /home/z1r0/fuzzing/yasm/yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #8 0x4c6eae in do_assemble /home/z1r0/fuzzing/yasm/yasm/frontends/yasm/yasm.c:521:5
    #9 0x4c6eae in main /home/z1r0/fuzzing/yasm/yasm/frontends/yasm/yasm.c:753:12
    #10 0x7f150c316082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x41c47d in _start (/home/z1r0/fuzzing/yasm/yasm/yasm+0x41c47d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/z1r0/fuzzing/yasm/yasm/modules/preprocs/nasm/nasm-pp.c in delete_Token
==3784849==ABORTING

Reference

https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/readme.md

@ArchanaWind
Copy link

Hi @z1r00

I have tried to reproduce the issue , I don't see the reported error "SEGV yasm/modules/preprocs/nasm/nasm-pp.c in delete_Token" instead I am seeing Memory leak in parse_instr, modules/parsers/nasm/nasm-parse.c

Host- Ubuntu-20.04
gcc - 11.3.0
yasm 1.3.0

./build/bin/yasm id:000176,sig:06,src:008442+007750,op:splice,rep:128

yasm: file name already has no extension: output will be in `yasm.out'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: instruction expected after label
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: expected `,'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: error: label or instruction expected at start of line
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `<'
id:000176,sig:06,src:008442+007750,op:splice,rep:128:1500: warning: ignoring unrecognized character `>'

=================================================================
==920657==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 4100 byte(s) in 4 object(s) allocated from:
    #0 0x7f71680a3867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5651bbe4b6bf in def_xmalloc libyasm/xmalloc.c:69
    #2 0x5651bbe2871e in yasm_error_set_va libyasm/errwarn.c:277
    #3 0x5651bbe28884 in yasm_error_set libyasm/errwarn.c:290
    #4 0x5651bbe78e10 in expect_ modules/parsers/nasm/nasm-parse.c:208
    #5 0x5651bbe7ceb3 in parse_instr modules/parsers/nasm/nasm-parse.c:768
    #6 0x5651bbe7b937 in parse_exp modules/parsers/nasm/nasm-parse.c:566
    #7 0x5651bbe797ff in parse_line modules/parsers/nasm/nasm-parse.c:289
    #8 0x5651bbe790d4 in nasm_parser_parse modules/parsers/nasm/nasm-parse.c:231
    #9 0x5651bbe7814b in nasm_do_parse modules/parsers/nasm/nasm-parser.c:66
    #10 0x5651bbe782e8 in nasm_parser_do_parse modules/parsers/nasm/nasm-parser.c:83
    #11 0x5651bbe1052c in do_assemble frontends/yasm/yasm.c:519
    #12 0x5651bbe1134f in main frontends/yasm/yasm.c:749
    #13 0x7f7167df0d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

Direct leak of 3075 byte(s) in 3 object(s) allocated from:
    #0 0x7f71680a3867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    #1 0x5651bbe4b6bf in def_xmalloc libyasm/xmalloc.c:69
    #2 0x5651bbe2871e in yasm_error_set_va libyasm/errwarn.c:277
    #3 0x5651bbe28884 in yasm_error_set libyasm/errwarn.c:290
    #4 0x5651bbe78e10 in expect_ modules/parsers/nasm/nasm-parse.c:208
    #5 0x5651bbe7ceb3 in parse_instr modules/parsers/nasm/nasm-parse.c:768
    #6 0x5651bbe7b937 in parse_exp modules/parsers/nasm/nasm-parse.c:566
    #7 0x5651bbe7af67 in parse_line modules/parsers/nasm/nasm-parse.c:454
    #8 0x5651bbe790d4 in nasm_parser_parse modules/parsers/nasm/nasm-parse.c:231
    #9 0x5651bbe7814b in nasm_do_parse modules/parsers/nasm/nasm-parser.c:66
    #10 0x5651bbe782e8 in nasm_parser_do_parse modules/parsers/nasm/nasm-parser.c:83
    #11 0x5651bbe1052c in do_assemble frontends/yasm/yasm.c:519
    #12 0x5651bbe1134f in main frontends/yasm/yasm.c:749
    #13 0x7f7167df0d8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 7175 byte(s) leaked in 7 allocation(s).

Could you please comment on it

@z1r00
Copy link
Author

z1r00 commented Apr 17, 2023

I directly git, the compiled yasm version is yasm 1.3.0.55.g101bc

@DaisyPo
Copy link

DaisyPo commented Apr 17, 2023

I directly git, the compiled yasm version is yasm 1.3.0.55.g101bc

Hello, I can reproduce the problem with git. It seems that you use a fuzzer similar to AFL, but when I use "export AFL_USE_ASAN=1 " and make with afl clang, it will fail because asan detects memory leaks. Have you ever encountered this situation before ? Thanks.

@ArchanaWind
Copy link

I still can not reproduce the issue

followed steps are :

$ git clone https://github.com/yasm/yasm.git
$ cd yasm
$ git branch
*master
$ ./autogen.sh && make distclean && CC=gcc CXX=g++ CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" ./configure --prefix=$PWD/build --disable-shared && make -j && make install

$ ./build/bin/yasm --version
yasm 1.3.0.55.g101bc
Compiled on Apr 17 2023.
Copyright (c) 2001-2014 Peter Johnson and other Yasm developers.
Run yasm --license for licensing overview and summary.

$ wget https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/id:000176%2Csig:06%2Csrc:008442%2B007750%2Cop:splice%2Crep:128
$./build/bin/yasm id:000176,sig:06,src:008442+007750,op:splice,rep:128

@z1r00 and @DaisyPo Could you please suggest are these steps are correct

@DaisyPo
Copy link

DaisyPo commented Apr 17, 2023

I can reproduce it but actually I didn't set CFLAGS and CXXFLAGS to use ASAN. I just compile it without asan and run the crash. It will be segmentation fault and can be analyzed with GDB.
image

@ArchanaWind
Copy link

I have compiled without ASAN and did not get any crash, @DaisyPo Could you please add the steps you have followed .

@DaisyPo
Copy link

DaisyPo commented Apr 17, 2023

Basically like this @ArchanaWind
$ git clone https://github.com/yasm/yasm.git
$ cd yasm
$ ./autogen.sh
make distclean
./configure --prefix=$PWD/build
make CC=gcc CXX=g++
make install

@ArchanaWind
Copy link

After make install what commands you have used to run the crash

@DaisyPo
Copy link

DaisyPo commented Apr 17, 2023

./yasm poc-file @ArchanaWind

@ArchanaWind
Copy link

ArchanaWind commented Apr 17, 2023

Same I have run but not seeing any crash

seeing only

id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: label or instruction expected at start of line
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: label or instruction expected at start of line
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: label or instruction expected at start of line
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: expected `,'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: label or instruction expected at start of line
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: error: label or instruction expected at start of line
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `<'
id:000051,sig:06,src:008025,op:havoc,rep:32:1437: warning: ignoring unrecognized character `>'

@DaisyPo are seeing above errors and warnings while running poc file with yasm binary

@DaisyPo
Copy link

DaisyPo commented Apr 17, 2023

I see this:
image
@ArchanaWind

@ArchanaWind
Copy link

ArchanaWind commented Apr 17, 2023

I am able to reproduce the issue, I have used wget command to download the poc file
$ wget https://github.com/z1r00/fuzz_vuln/blob/main/yasm/segv/delete_Token/id:000176%2Csig:06%2Csrc:008442%2B007750%2Cop:splice%2Crep:128
with this I am unable to reproduce the issue. Instead I have downloaded poc file to pc and copied to yasm directory with this I am able to reproduce it.

Thanks you @DaisyPo and @z1r00

Did any one have fix for this issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants