Project: libsass (sass/libsass), language: c++
Vulnerability instance: libsass.cve-2018-20821
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/sass/libsass/issues/2658
## Description:
Issue: sass/libsass#2658
Title: AddressSanitizer: stack-overflow when creating String_Schema_Obj (parser.cpp:1808)
State: closed
Created by: hongxuchen
Created at: 2018-06-02 07:13:45+00:00
Labels: Fuzzy

Issue Body:
We found with our fuzzer some stack over flow errors when constructing `String_Schema_Obj` at Line 1808 in parser.cpp (45f50873962b7d1c66bd115ba6e644bdaaf6cac1) when compiled with Address Sanitizer (using sassc as the driver).

```
ASAN:SIGSEGV
=================================================================
==17368==ERROR: AddressSanitizer: stack-overflow on address 0x7fff100a5b48 (pc 0x7f979147d485 bp 0x7fff100a6390 sp 0x7fff100a5b30 T0)
    #0 0x7f979147d484 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99484)
    #1 0x7f9790f2e592 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1808
    #2 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #3 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #4 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #5 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #6 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #7 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #8 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #9 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #10 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #11 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #12 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #13 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #14 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #15 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #16 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #17 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #18 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #19 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
...
    #248 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #249 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835
    #250 0x7f9790f31fd8 in Sass::Parser::parse_css_variable_value(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1794
    #251 0x7f9790f2faf0 in Sass::Parser::parse_css_variable_value_token(bool) /home/hongxu/FUZZ/libsass-orig/src/parser.cpp:1835

SUMMARY: AddressSanitizer: stack-overflow ??:0 operator new(unsigned long)
==17368==ABORTING

```

sample inputs:
[test_s101.txt](https://github.com/sass/libsass/files/2064767/test_s101.txt)
[test_s203.txt](https://github.com/sass/libsass/files/2064768/test_s203.txt)
[test_s205.txt](https://github.com/sass/libsass/files/2064769/test_s205.txt)
[test_s402.txt](https://github.com/sass/libsass/files/2064770/test_s402.txt)



Comments:
Comment by hongxuchen on 2018-06-03 04:59:16+00:00:
Other relevant input files (some of them emit different different call stacks in different runs):
[so_parser.cpp:1808_01.txt](https://github.com/sass/libsass/files/2065678/so_parser.cpp.1808_01.txt)
[so_parser.cpp:1792_01.txt](https://github.com/sass/libsass/files/2065680/so_parser.cpp.1792_01.txt)
[so_parser.cpp:1792_02.txt](https://github.com/sass/libsass/files/2065681/so_parser.cpp.1792_02.txt)
[so_parser.cpp:1846_01.txt](https://github.com/sass/libsass/files/2065683/so_parser.cpp.1846_01.txt)


---

Comment by glebm on 2019-04-10 19:24:44+00:00:
Still broken on master

---

Comment by glebm on 2019-04-10 19:30:03+00:00:
Minimal repro:

```bash
echo "a{--b:$(printf '[%.0s' {1..2800})" | sassc/bin/sassc
```

---

Comment by xi on 2019-06-05 05:35:48+00:00:
Assigned CVE-2018-20821

Attachments:
https://github.com/sass/libsass/files/2064768/test_s203.txt
https://github.com/sass/libsass/files/2065680/so_parser.cpp.1792_01.txt
https://github.com/sass/libsass/files/2064770/test_s402.txt
https://github.com/sass/libsass/files/2065683/so_parser.cpp.1846_01.txt
https://github.com/sass/libsass/files/2065681/so_parser.cpp.1792_02.txt
https://github.com/sass/libsass/files/2065678/so_parser.cpp.1808_01.txt
https://github.com/sass/libsass/files/2064767/test_s101.txt
https://github.com/sass/libsass/files/2064769/test_s205.txt

Commit References:
45f50873962b7d1c66bd115ba6e644bdaaf6cac1

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export BUILD='static'
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool
RUN git clone https://github.com/sass/libsass libsass
RUN git -C libsass checkout 39e30874b9a5dd6a802c20e8b0470ba44eeba929
WORKDIR $SRC/libsass
COPY build.sh $SRC/

Additional files:
filename: data_context_fuzzer.cc
content: #include "sass.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  char* sass_data = (char*) malloc(sizeof(char) * size + 1);
  if (sass_data == NULL) return 0;

  memcpy(sass_data, data, size);
  sass_data[size] = '\0';

  struct Sass_Data_Context* ctx = sass_make_data_context(sass_data);
  if (ctx == NULL) {
    free(sass_data);
    return 0;
  }

  struct Sass_Options* options = sass_make_options();
  if (options == NULL) {
    sass_delete_data_context(ctx);
    return 0;
  }

  sass_option_set_output_style(options, SASS_STYLE_NESTED);
  sass_option_set_precision(options, 5);

  sass_data_context_set_options(ctx, options);
  sass_compile_data_context(ctx);

  sass_delete_data_context(ctx);
  sass_delete_options(options);

  return 0;
}