Project: yaml-cpp (jbeder/yaml-cpp), language: c++
Vulnerability instance: yaml-cpp.cve-2018-20573
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/jbeder/yaml-cpp/issues/655
## Description:
Issue: jbeder/yaml-cpp#655
Title: Stack Overflow in Scanner::EnsureTokensInQueue() 
State: closed
Created by: E4ck
Created at: 2018-12-28 08:13:29+00:00

Issue Body:
Stack Overflow in Scanner::EnsureTokensInQueue() 

**position：**[code](https://github.com/jbeder/yaml-cpp/blob/562aefc114938e388457e6a531ed7b54d9dc1b62/src/scanner.cpp#L48)

**[poc](https://github.com/jbeder/yaml-cpp/files/2714360/crash2.txt)**

**To reproduce:** `./parse < crash2.txt`

**gdb:**
`Program received signal SIGSEGV, Segmentation fault.`
`0x0807598e in YAML::Scanner::EnsureTokensInQueue() ()`

**ASAN:**
`ASAN:DEADLYSIGNAL`
`=================================================================
==2258==ERROR: AddressSanitizer: stack-overflow on address 0xbf338fa0 (pc 0x0814e423 bp 0xbf3393c8 sp 0xbf338f90 T0)`
`    #0 0x814e422  (/home/user/yaml-cpp/build/util/parse+0x814e422)`
`    #1 0x816fd48  (/home/user/yaml-cpp/build/util/parse+0x816fd48)`
`    #2 0x8190a72  (/home/user/yaml-cpp/build/util/parse+0x8190a72)`
`    #3 0x81d5061  (/home/user/yaml-cpp/build/util/parse+0x81d5061)`
`    #4 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #5 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #6 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #7 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #8 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #9 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    #10 0x81deb85  (/home/user/yaml-cpp/build/util/parse+0x81deb85)`
`    #11 0x81d511a  (/home/user/yaml-cpp/build/util/parse+0x81d511a)`
`    ......                                                                                                         `
`    #245 0x81d511a  (/home/eack/yaml-cpp/build/util/parse+0x81d511a)`
`    #246 0x81deb85  (/home/eack/yaml-cpp/build/util/parse+0x81deb85)`
`    #247 0x81d511a  (/home/eack/yaml-cpp/build/util/parse+0x81d511a)`
`    #248 0x81deb85  (/home/eack/yaml-cpp/build/util/parse+0x81deb85)`
`    #249 0x81d511a  (/home/eack/yaml-cpp/build/util/parse+0x81d511a)`
`    #250 0x81deb85  (/home/eack/yaml-cpp/build/util/parse+0x81deb85)`
`SUMMARY: AddressSanitizer: stack-overflow (/home/eack/yaml-cpp/build/util/parse+0x814e422) 
==2258==ABORTING`




Comments:
Comment by carnil on 2018-12-28 20:51:30+00:00:
[CVE-2018-20573](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20573)

---

Comment by Justinzobel on 2019-09-05 04:30:34+00:00:
Is there a patch available for this vulnerability?

---

Comment by NicoleG25 on 2020-04-07 11:19:04+00:00:
@jbeder , @rdeterre 
Was this issue ever addressed? and if so could you point out in what commit?

Thanks in advance !

---

Comment by jbeder on 2020-04-07 16:29:58+00:00:
I just reviewed #807. Sorry for the delay.

---

Comment by NicoleG25 on 2020-04-08 07:23:32+00:00:
> I just reviewed #807. Sorry for the delay.

Would you be merging it?
Thanks in advance !

---

Comment by jbeder on 2020-04-08 20:25:56+00:00:
When the review comments are addressed.

On Wed, Apr 8, 2020 at 2:23 AM Nicole <notifications@github.com> wrote:

> I just reviewed #807 <https://github.com/jbeder/yaml-cpp/pull/807>. Sorry
> for the delay.
>
> Would you be merging it?
> Thanks in advance !
>
> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/jbeder/yaml-cpp/issues/655#issuecomment-610796206>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAICUBRTRB26IL34AKNLMETRLQRAFANCNFSM4GMOLGEQ>
> .
>


---

Comment by mcandre on 2022-04-03 20:13:05+00:00:
So was this vulnerability patched or what? Unclear.

---

Comment by jbeder on 2022-04-03 20:31:35+00:00:
Yes. #807 was merged.

Attachments:
https://github.com/jbeder/yaml-cpp/files/2714360/crash2.txt

Commit References:
562aefc114938e388457e6a531ed7b54d9dc1b62

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
mkdir -p build
cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j4

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make cmake
RUN apt-get install -y make cmake
RUN git clone https://github.com/jbeder/yaml-cpp yaml-cpp
RUN git -C yaml-cpp checkout 562aefc114938e388457e6a531ed7b54d9dc1b62
WORKDIR $SRC/yaml-cpp
COPY build.sh $SRC/

Additional files: