Project: libsass (sass/libsass), language: c++
Vulnerability instance: libsass.cve-2018-19838
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/sass/libsass/issues/2660
## Description:
Issue: sass/libsass#2660
Title: AddressSanitizer: stack-overflow at IMPLEMENT_AST_OPERATORS expansion
State: closed
Created by: hongxuchen
Created at: 2018-06-02 07:32:14+00:00
Labels: Bug - Confirmed, Bug - Selectors, selector-validation, Fuzzy

Issue Body:
We found with our fuzzer some stack over flow errors when executing on `IMPLEMENT_AST_OPERATORS` expansion inside ast.cpp (exact lines may differ in 2163 or 2164 when compiled with different optimizations, 45f50873962b7d1c66bd115ba6e644bdaaf6cac1) when compiled with Address Sanitizer (using sassc as the driver).

```
ASAN:SIGSEGV
=================================================================
==17364==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe07614ff8 (pc 0x7f79ff50c279 bp 0x0000000000e8 sp 0x7ffe07614ff0 T0)
    #0 0x7f79ff50c278  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xb0278)
    #1 0x7f79ff50bd67  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0xafd67)
    #2 0x7f79ff47ef4f  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x22f4f)
    #3 0x7f79ff4f54fe in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x994fe)
    #4 0x7f79fedf58ea in Sass::Compound_Selector::copy() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2163
    #5 0x7f79fede080a in Sass::Compound_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2163
    #6 0x7f79fedee303 in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1490
    #7 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #8 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #9 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #10 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #11 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #12 0x7f79fedebda7 in Sass::Selector_List::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1504
    #13 0x7f79fede09b7 in Sass::Selector_List::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2170
...
    #248 0x7f79fedee48c in Sass::Complex_Selector::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1491
    #249 0x7f79fede08b7 in Sass::Complex_Selector::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2164
    #250 0x7f79fedebda7 in Sass::Selector_List::cloneChildren() /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:1504
    #251 0x7f79fede09b7 in Sass::Selector_List::clone() const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:2170

SUMMARY: AddressSanitizer: stack-overflow ??:0 ??
==17364==ABORTING
```

Sample input files:
[test_s201.txt](https://github.com/sass/libsass/files/2064780/test_s201.txt)
[test_s202.txt](https://github.com/sass/libsass/files/2064781/test_s202.txt)
[test_s204.txt](https://github.com/sass/libsass/files/2064782/test_s204.txt)


Comments:
Comment by hongxuchen on 2018-06-03 04:34:22+00:00:
Other input files:
[so_ast.cpp:2163_01.txt](https://github.com/sass/libsass/files/2065646/so_ast.cpp.2163_01.txt)
[so_ast.cpp:2163_02.txt](https://github.com/sass/libsass/files/2065647/so_ast.cpp.2163_02.txt)
[so_ast.cpp:2164_01.txt](https://github.com/sass/libsass/files/2065648/so_ast.cpp.2164_01.txt)
[so_ast.cpp:2165_01.txt](https://github.com/sass/libsass/files/2065649/so_ast.cpp.2165_01.txt)
[so_ast.cpp:2170_01.txt](https://github.com/sass/libsass/files/2065651/so_ast.cpp.2170_01.txt)
[so_ast.cpp:2170_02.txt](https://github.com/sass/libsass/files/2065652/so_ast.cpp.2170_02.txt)


---

Comment by xzyfer on 2018-07-04 11:06:25+00:00:
Thanks for the report. 
We confirmed this issue shares a common root cause to other reported issues.
We have assigned the `selector-validation` to the affected issues.

---

Comment by glebm on 2018-11-25 12:04:23+00:00:
The three cases from the original post no longer fail.
All the "Other input files" from https://github.com/sass/libsass/issues/2660#issuecomment-394134419 still fail.

---

Comment by glebm on 2018-11-26 21:55:26+00:00:
A simple reproduction:

```scss
:not(f(x)) {
  color: red;
  @extend x;
}
```

sassc: Stack Overflow.

dart-sass:

```
Error: expected ")".
a:not(f(x)){
       ^
  ../../../tmp/so2.scss 1:8  root stylesheet
```

ruby-sass:

```
Error: Invalid CSS after "a:not(f": expected ")", was "(x))"
        on line 1 of /home/glebm/tmp/so2.scss
  Use --trace for backtrace.
``

---

Comment by glebm on 2019-04-10 19:22:02+00:00:
This is fixed on master (not sure by which commit)

---

Comment by gate5 on 2019-06-27 12:31:42+00:00:
Can you please explain where is the fix commit? And what is the specific version that contains this fix?

NVD says about the vulnerability CVE-2018-19838: "In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy()." with a reference to this issue #2660.


Attachments:
https://github.com/sass/libsass/files/2065646/so_ast.cpp.2163_01.txt
https://github.com/sass/libsass/files/2065649/so_ast.cpp.2165_01.txt
https://github.com/sass/libsass/files/2065651/so_ast.cpp.2170_01.txt
https://github.com/sass/libsass/files/2065652/so_ast.cpp.2170_02.txt
https://github.com/sass/libsass/files/2064782/test_s204.txt
https://github.com/sass/libsass/files/2064780/test_s201.txt
https://github.com/sass/libsass/files/2065648/so_ast.cpp.2164_01.txt
https://github.com/sass/libsass/files/2064781/test_s202.txt
https://github.com/sass/libsass/files/2065647/so_ast.cpp.2163_02.txt

Commit References:
45f50873962b7d1c66bd115ba6e644bdaaf6cac1

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export BUILD='static'
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool
RUN git clone https://github.com/sass/libsass libsass
RUN git -C libsass checkout 9ce7a7fd913b70dab2107edb2e50aff7bacc56af
WORKDIR $SRC/libsass
COPY build.sh $SRC/

Additional files:
filename: data_context_fuzzer.cc
content: #include "sass.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  char* sass_data = (char*) malloc(sizeof(char) * size + 1);
  if (sass_data == NULL) return 0;

  memcpy(sass_data, data, size);
  sass_data[size] = '\0';

  struct Sass_Data_Context* ctx = sass_make_data_context(sass_data);
  if (ctx == NULL) {
    free(sass_data);
    return 0;
  }

  struct Sass_Options* options = sass_make_options();
  if (options == NULL) {
    sass_delete_data_context(ctx);
    return 0;
  }

  sass_option_set_output_style(options, SASS_STYLE_NESTED);
  sass_option_set_precision(options, 5);

  sass_data_context_set_options(ctx, options);
  sass_compile_data_context(ctx);

  sass_delete_data_context(ctx);
  sass_delete_options(options);

  return 0;
}