Project: yara (virustotal/yara), language: c++
Vulnerability instance: yara.cve-2016-10210
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/VirusTotal/yara/issues/576
## Description:
Issue: VirusTotal/yara#576
Title: Null Pointer Dereference in yy_get_next_buffer()
State: closed
Created by: fumfel
Created at: 2016-12-06 09:18:57+00:00

Issue Body:
**Null Pointer Dereference in yy_get_next_buffer()**

Tested on latest Git HEAD: 779b9a77aa4377152a5cba031255029afb0c19a5

[Payload](https://github.com/VirusTotal/yara/files/633382/yara_null_ptr.txt)


To reproduce: `yara yara_null_ptr.yar strings`

ASAN output:

```
==10216==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f7f083c71ba bp 0x000000000001 sp 0x7ffe9eece890 T0)
==10216==The signal is caused by a READ memory access.
==10216==Hint: address points to the zero page.
    #0 0x7f7f083c71b9 in fread (/lib/x86_64-linux-gnu/libc.so.6+0x6e1b9)
    #1 0x52b81f in yy_get_next_buffer XYZ/yara/libyara/re_lexer.c:1573:3
    #2 0x5242e0 in re_yylex XYZ/yara/libyara/re_lexer.c:1413:17
    #3 0x5af3ce in re_yyparse XYZ/yara/libyara/re_grammar.c:1252:16
    #4 0x531215 in yr_parse_re_string XYZ/yara/libyara/re_lexer.l:610:3
    #5 0x5a996a in yr_parser_reduce_string_declaration XYZ/yara/libyara/parser.c:519:31
    #6 0x575db9 in yara_yyparse XYZ/yara/libyara/grammar.y:529:26
    #7 0x50c3d0 in yr_lex_parse_rules_file XYZ/yara/libyara/lexer.l:815:3
    #8 0x4f097e in yr_compiler_add_file XYZ/yara/libyara/compiler.c:357:12
    #9 0x4ee0c4 in main XYZ/yara/yara.c:1124:17
    #10 0x7f7f0837982f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x41a408 in _start (/usr/local/bin/yara+0x41a408)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/lib/x86_64-linux-gnu/libc.so.6+0x6e1b9) in fread
==10216==ABORTING
```



Comments:
Comment by plusvic on 2017-01-04 15:18:38+00:00:
Fixed in eb491e03851a11bc811173f5e13c89cefa7257ac

---

Comment by fumfel on 2017-01-05 11:53:58+00:00:
Still exist in 890c3f850293176c0e996a602ffa88b315f4e98f

[Payload](https://github.com/VirusTotal/yara/files/687165/yara_null_ptr_new.txt)




---

Comment by plusvic on 2017-01-05 15:16:28+00:00:
Mmmm, if the regexp is /\x/ it detects the end of the buffer and returns:

```
invalid regular expression "$": unexpected end of buffer 
```

Are you getting a SEGV with the change in eb491e03851a11bc811173f5e13c89cefa7257ac ?

---

Comment by fumfel on 2017-01-08 11:23:56+00:00:
Yup - with and without ASAN.

Here's my config:
Ubuntu 16.04 x64
CC: Clang 3.9 & gcc version 5.4.0 (tested on both) 

---

Comment by plusvic on 2017-01-09 11:46:35+00:00:
Can you send a stack trace? I'm trying to reproduce the issue to no avail. 

---

Comment by hillu on 2017-01-09 23:17:24+00:00:
@plusvic The issue is identical to #503; I fixed that in #586. (The Travis OSX failures there would be fixed by merging #587.)

---

Comment by fgeek on 2017-04-04 05:18:53+00:00:
CVE-2016-10210 has been assigned for this issue.

Attachments:
https://github.com/VirusTotal/yara/files/633382/yara_null_ptr.txt
https://github.com/VirusTotal/yara/files/687165/yara_null_ptr_new.txt

Commit References:
779b9a77aa4377152a5cba031255029afb0c19a5
890c3f850293176c0e996a602ffa88b315f4e98f
eb491e03851a11bc811173f5e13c89cefa7257ac

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
./bootstrap.sh
./configure --enable-macho --enable-debug --enable-dex --enable-dotnet --without-crypto
make clean -j$(nproc)
make -j$(nproc) all
make install -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y automake autoconf make libtool pkg-config bison flex
RUN git clone https://github.com/virustotal/yara yara
RUN git -C yara checkout d68cd32fabb0b7703ada455dfa5b38ef03132907
WORKDIR $SRC/yara
COPY build.sh $SRC/

Additional files: