AddressSanitizer: heap-buffer-overflow (OOB read) in Sass::Prelexer::exactly (libsass/src/lexer.hpp:93:14)

[glen-mac]

Hey there, I have discovered an out-of-bands read (OOB) in libsass at: libsass/src/lexer.hpp:93:14

Found when fuzzing commit 60f8391 of libsass, using commit aa6d5c6 of sassc as a harness.

Compile flags to reproduce:

CC=clang CXX=clang++ CFLAGS='-fsanitize=address -g -O2 -fno-omit-frame-pointer' CXXFLAGS=$CFLAGS make -C sassc -j8

System information:

$ uname -a
Linux s127422 3.13.0-137-generic #186-Ubuntu SMP Mon Dec 4 19:09:19 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

This bug was found to be in libsass releases from 3.3.2 until the commit tested above.

You can find a collection of PoC files that trigger the bug here.

The full ASAN report can be found here (symbols names too long to bother showing).

==14124==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d00000cff1 at pc 0x0000006be6c1 bp 0x7fff2a90 0fc0 sp 0x7fff2a900fb8
READ of size 1 at 0x60d00000cff1 thread T0
    #0 0x6be6c0 in char const* Sass::Prelexer::exactly<(char)92>(char const*) /home/glenn/temp/libsass/src/lexer.hpp:93:14
...
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/glenn/temp/libsass/src/lexer.hpp:93:14 in char const* Sass::Prelexer::exactly<(char)92>(char const*)
...

[glebm]

Only the following case still fails: id:000449,sig:06,src:008670+009131,op:splice,rep:8. A memory leak not an OOB though.