Project: yaml-cpp (jbeder/yaml-cpp), language: c++
Vulnerability instance: yaml-cpp.cve-2019-6285
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/jbeder/yaml-cpp/issues/660
## Description:
Issue: jbeder/yaml-cpp#660
Title: Stack Overflow in SingleDocParser::HandleFlowSequence(YAML::EventHandler&) ()
State: closed
Created by: E4ck
Created at: 2019-01-14 07:58:28+00:00

Issue Body:
Stack Overflow in SingleDocParser::HandleFlowSequence(YAML::EventHandler&) ()

position：[code](https://github.com/jbeder/yaml-cpp/blob/b87c76a2ef4f974e2739a2d410ee5e36122cfc00/src/singledocparser.cpp#L183)

[poc](https://github.com/jbeder/yaml-cpp/files/2754280/crash0.zip)

To reproduce: `./parse < crash0`

gdb:
`Program received signal SIGSEGV, Segmentation fault.`
`0x0807e61d in YAML::SingleDocParser::HandleFlowSequence(YAML::EventHandler&) ()`

ASAN:

    ASAN:DEADLYSIGNAL
    =================================================================
    ==9579==ERROR: AddressSanitizer: stack-overflow on address 0xbf6a8fc0 (pc 0x0814e3e3 bp 0xbf6a93e8 sp 0xbf6a8fb0 T0)
        #0 0x814e3e2  (/home/eack/yaml-cpp/build2/util/parse+0x814e3e2)
        #1 0x816fde8  (/home/eack/yaml-cpp/build2/util/parse+0x816fde8)
        #2 0x818f283  (/home/eack/yaml-cpp/build2/util/parse+0x818f283)
        #3 0x81d41b8  (/home/eack/yaml-cpp/build2/util/parse+0x81d41b8)
        #4 0x81d966a  (/home/eack/yaml-cpp/build2/util/parse+0x81d966a)
        #5 0x81d4528  (/home/eack/yaml-cpp/build2/util/parse+0x81d4528)
        #6 0x81dfdc9  (/home/eack/yaml-cpp/build2/util/parse+0x81dfdc9)
        #7 0x81d47fc  (/home/eack/yaml-cpp/build2/util/parse+0x81d47fc)
        #8 0x81d966a  (/home/eack/yaml-cpp/build2/util/parse+0x81d966a)
        #9 0x81d4528  (/home/eack/yaml-cpp/build2/util/parse+0x81d4528)
        #10 0x81dfdc9  (/home/eack/yaml-cpp/build2/util/parse+0x81dfdc9)
        #11 0x81d47fc  (/home/eack/yaml-cpp/build2/util/parse+0x81d47fc)
        #12 0x81d966a  (/home/eack/yaml-cpp/build2/util/parse+0x81d966a)
        #13 0x81d4528  (/home/eack/yaml-cpp/build2/util/parse+0x81d4528)
        #14 0x81dfdc9  (/home/eack/yaml-cpp/build2/util/parse+0x81dfdc9)
        #15 0x81d47fc  (/home/eack/yaml-cpp/build2/util/parse+0x81d47fc)
        ......
        #243 0x81d47fc  (/home/eack/yaml-cpp/build2/util/parse+0x81d47fc)
        #244 0x81d966a  (/home/eack/yaml-cpp/build2/util/parse+0x81d966a)
        #245 0x81d4528  (/home/eack/yaml-cpp/build2/util/parse+0x81d4528)
        #246 0x81dfdc9  (/home/eack/yaml-cpp/build2/util/parse+0x81dfdc9)
        #247 0x81d47fc  (/home/eack/yaml-cpp/build2/util/parse+0x81d47fc)
        #248 0x81d966a  (/home/eack/yaml-cpp/build2/util/parse+0x81d966a)
        #249 0x81d4528  (/home/eack/yaml-cpp/build2/util/parse+0x81d4528)
        #250 0x81dfdc9  (/home/eack/yaml-cpp/build2/util/parse+0x81dfdc9)
    
    SUMMARY: AddressSanitizer: stack-overflow (/home/eack/yaml-cpp/build2/util/parse+0x814e3e2) 
    ==9579==ABORTING






Comments:
Comment by wcventure on 2019-01-17 12:50:02+00:00:
CVE-2019-6292

---

Comment by E4ck on 2019-02-14 06:58:23+00:00:
CVE-2019-6285

---

Comment by iamleot on 2019-03-08 13:35:20+00:00:
It seems that CVE-2019-6285 is a duplicate of CVE-2018-20710 (same description and same references) and - maybe - CVE-2019-6285 and CVE-2018-20710 are a duplicate of CVE-2019-6292.  If that's the case @E4ck, @wcventure, can you please update the status of the CVE in order to avoid duplicates?

Thank you!

---

Comment by iamleot on 2019-03-08 13:36:43+00:00:
...and, if CVE-2019-6285 is a duplicate of CVE-2019-6292 then this issue is probably a duplicate of #657.

---

Comment by sgayou on 2019-03-08 17:36:41+00:00:
Yeah, this does look like a dupe after a high-level look. Here's my gdb backtrace with symbols:

```
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7b4bb7a in _int_malloc () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff7b4bb7a in _int_malloc () from /lib64/libc.so.6
#1  0x00007ffff7b4db07 in malloc () from /lib64/libc.so.6
#2  0x00007ffff7ec3b9c in operator new (sz=48) at ../../../../libstdc++-v3/libsupc++/new_op.cc:50
#3  0x000000000043fd71 in __gnu_cxx::new_allocator<std::_Rb_tree_node<std::shared_ptr<YAML::detail::node> > >::allocate(unsigned long, void const*) ()
#4  0x000000000043fce1 in std::allocator_traits<std::allocator<std::_Rb_tree_node<std::shared_ptr<YAML::detail::node> > > >::allocate(std::allocator<std::_Rb_tree_node<std::shared_ptr<YAML::detail::node> > >&, unsigned long) ()
... # truncated here a bit, lots of templates.
#10 0x000000000043e733 in std::set<std::shared_ptr<YAML::detail::node>, std::less<std::shared_ptr<YAML::detail::node> >, std::allocator<std::shared_ptr<YAML::detail::node> > >::insert(std::shared_ptr<YAML::detail::node> const&) ()
#11 0x000000000043e2a8 in YAML::detail::memory::create_node() ()
#12 0x0000000000435cbe in YAML::detail::memory_holder::create_node() ()
#13 0x000000000043911a in YAML::NodeBuilder::Push(YAML::Mark const&, unsigned long) ()
#14 0x0000000000438fbb in YAML::NodeBuilder::OnSequenceStart(YAML::Mark const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned long, YAML::EmitterStyle::value) ()
#15 0x000000000042b987 in YAML::SingleDocParser::HandleNode(YAML::EventHandler&) ()
#16 0x000000000042cd3e in YAML::SingleDocParser::HandleCompactMap(YAML::EventHandler&) ()
#17 0x000000000042c482 in YAML::SingleDocParser::HandleMap(YAML::EventHandler&) ()
#18 0x000000000042bb99 in YAML::SingleDocParser::HandleNode(YAML::EventHandler&) ()
#19 0x000000000042c1fd in YAML::SingleDocParser::HandleFlowSequence(YAML::EventHandler&) ()
#20 0x000000000042bd5e in YAML::SingleDocParser::HandleSequence(YAML::EventHandler&) ()
#21 0x000000000042b9a0 in YAML::SingleDocParser::HandleNode(YAML::EventHandler&) ()
#22 0x000000000042cd3e in YAML::SingleDocParser::HandleCompactMap(YAML::EventHandler&) ()
#23 0x000000000042c482 in YAML::SingleDocParser::HandleMap(YAML::EventHandler&) ()
#24 0x000000000042bb99 in YAML::SingleDocParser::HandleNode(YAML::EventHandler&) ()
```


---

Comment by iamleot on 2019-03-09 11:16:17+00:00:
Thanks @sgayou!

I have just requested to mark CVE-2018-20710 as duplicate to CVE-2019-6285 via [CVE Request web form](https://cveform.mitre.org/) and I will share any updates about that.

---

Comment by iamleot on 2019-04-18 09:52:20+00:00:
Leonardo Taccari writes:
> [...]
> I have just requested to mark CVE-2018-20710 as duplicate to CVE-2019-6285 via [CVE Request web form](https://cveform.mitre.org/) and I will share any updates about that.
> [...]

JFTR, CVE-2018-20710 is now rejected and marked as duplicated to
CVE-2019-6285.


---

Comment by NicoleG25 on 2019-12-26 13:59:27+00:00:
Is there any fix to the issue though? Thanks :)

Attachments:
https://github.com/jbeder/yaml-cpp/files/2754280/crash0.zip

Commit References:
b87c76a2ef4f974e2739a2d410ee5e36122cfc00

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake
RUN apt-get install -y make cmake
RUN git clone https://github.com/jbeder/yaml-cpp yaml-cpp
RUN git -C yaml-cpp checkout 562aefc114938e388457e6a531ed7b54d9dc1b62
WORKDIR $SRC/yaml-cpp
COPY build.sh $SRC/

Additional files: