Project: yaml-cpp (jbeder/yaml-cpp), language: c++
Vulnerability instance: yaml-cpp.cve-2018-20574
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/jbeder/yaml-cpp/issues/654
## Description:
Issue: jbeder/yaml-cpp#654
Title: Stack Overflow in SingleDocParser::HandleFlowMap()
State: closed
Created by: E4ck
Created at: 2018-12-28 07:51:02+00:00

Issue Body:
Stack Overflow in SingleDocParser::HandleFlowMap()

**position：**[code](https://github.com/jbeder/yaml-cpp/blob/562aefc114938e388457e6a531ed7b54d9dc1b62/src/singledocparser.cpp#L275)

**[poc](https://github.com/jbeder/yaml-cpp/files/2714271/crash9.txt)**

**To reproduce:** `./parse < crash9.txt`

**gdb:**
`Program received signal SIGSEGV, Segmentation fault.`
`0x08081d5d in YAML::SingleDocParser::HandleFlowMap(YAML::EventHandler&) ()`

**ASAN:**
`ASAN:DEADLYSIGNAL`
`=================================================================
==6596==ERROR: AddressSanitizer: stack-overflow on address 0xbf09dee0 (pc 0x0814e423 bp 0xbf09e308 sp 0xbf09ded0 T0)`
`    #0 0x814e422  (/home/user/yaml-cpp/build/util/parse+0x814e422)`
`    #1 0x816fd48  (/home/user/yaml-cpp/build/util/parse+0x816fd48)`
`    #2 0x8190a72  (/home/user/yaml-cpp/build/util/parse+0x8190a72)`
`    #3 0x81d5061  (/home/user/yaml-cpp/build/util/parse+0x81d5061)`
`    #4 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #5 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #6 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #7 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #8 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #9 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #10 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    ......                                                                                                         `
`    #247 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #248 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #249 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #250 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`SUMMARY: AddressSanitizer: stack-overflow (/home/user/yaml-cpp/build/util/parse+0x814e422) 
==6596==ABORTING`


Comments:
Comment by carnil on 2018-12-28 20:51:09+00:00:
[CVE-2018-20574]( http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20574)

---

Comment by NicoleG25 on 2020-04-07 11:25:47+00:00:
@jbeder Was this ever addressed?
Thanks in advance !

---

Comment by jbeder on 2020-04-07 16:16:06+00:00:
I don't think so.

Attachments:
https://github.com/jbeder/yaml-cpp/files/2714271/crash9.txt

Commit References:
562aefc114938e388457e6a531ed7b54d9dc1b62

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake
RUN apt-get install -y make cmake
RUN git clone https://github.com/jbeder/yaml-cpp yaml-cpp
RUN git -C yaml-cpp checkout 562aefc114938e388457e6a531ed7b54d9dc1b62
WORKDIR $SRC/yaml-cpp
COPY build.sh $SRC/

Additional files: