Project: md4c (mity/md4c), language: c++
Vulnerability instance: md4c.cve-2020-26148
Sanitizer: memory

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/mity/md4c/issues/130
## Description:
Issue: mity/md4c#130
Title: Use of uninitialized value in the md_push_block_bytes() function
State: closed
Created by: fcambus
Created at: 2020-09-29 12:42:58+00:00
Labels: bug

Issue Body:
Hi,

While fuzzing md4c 0.4.5 with Honggfuzz, I found out that the md_push_block_bytes() function may use uninitialized memory.

Attaching a reproducer (gzipped so GitHub accepts it): [test01.md.gz](https://github.com/mity/md4c/files/5298987/test01.md.gz)

Issue can be reproduced by running:

```
md2html test01.md
```

```
==257142==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x7f6d02f3e5ed in md_push_block_bytes /home/fcambus/md4c-release-0.4.5/src/md4c.c:4848:12
    #1 0x7f6d02f3e5ed in md_start_new_block /home/fcambus/md4c-release-0.4.5/src/md4c.c:4868:25
    #2 0x7f6d02f3e5ed in md_process_line /home/fcambus/md4c-release-0.4.5/src/md4c.c:6147:9
    #3 0x7f6d02f3e5ed in md_process_doc /home/fcambus/md4c-release-0.4.5/src/md4c.c:6218:9
    #4 0x7f6d02f337e5 in md_parse /home/fcambus/md4c-release-0.4.5/src/md4c.c:6295:11
    #5 0x7f6d02f6f5c2 in md_html /home/fcambus/md4c-release-0.4.5/src/md4c-html.c:571:12
    #6 0x4964a9 in process_file /home/fcambus/md4c-release-0.4.5/md2html/md2html.c:144:11
    #7 0x4964a9 in main /home/fcambus/md4c-release-0.4.5/md2html/md2html.c:368:11
    #8 0x7f6d02bac0b2 in __libc_start_main /build/glibc-ZN95T4/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x41c29d in _start (/home/fcambus/md4c-release-0.4.5/md2html/md2html+0x41c29d)

SUMMARY: MemorySanitizer: use-of-uninitialized-value /home/fcambus/md4c-release-0.4.5/src/md4c.c:4848:12 in md_push_block_bytes
```


Comments:
Comment by mity on 2020-09-29 13:13:03+00:00:
Ack. In debug build, it even leads to an assertion.

Thanks for reporting it.


---

Comment by mity on 2020-09-29 19:40:22+00:00:
I'm now sitting at a Windows machine and cannot really use memory sanitizer here, but the commit fixed the assertion in the debug build. I believe it is just another manifestation of the same bug.

Feel free to reopen if you still see the same trouble with it.

---

Comment by fcambus on 2020-09-29 19:42:26+00:00:
This issue has been assigned [CVE-2020-26148](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26148).

---

Comment by fcambus on 2020-09-29 19:47:27+00:00:
Looks good to me, I can confirm commit  22ca89a fixes the issue. Thanks!

---

Comment by mity on 2020-09-29 21:54:13+00:00:
For the sake of completeness, this bash command triggers it too in 0.4.5:

```
$ printf '\0x\n' | md2html
```


Attachments:
https://github.com/mity/md4c/files/5298987/test01.md.gz

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build && cd build
cmake ../ -DBUILD_SHARED_LIBS=OFF
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake
RUN git clone https://github.com/mity/md4c md4c
RUN git -C md4c checkout db7d1c92ec34cae9624be373726e36f22a7d7019
WORKDIR $SRC/md4c
COPY build.sh $SRC/

Additional files: