Project: radare2 (radareorg/radare2), language: c++
Vulnerability instance: radare2.cve-2025-1378
Sanitizer: address

================= Bug Report (1/2) ==================
## Source: GitHub Issue
## URL: https://github.com/radareorg/radare2/issues/23953
## Description:
Issue: radareorg/radare2#23953
Title: rasm2 negative-size-param error in r_main_rasm2
State: closed
Created by: Ekkosun
Created at: 2025-02-11 05:42:20+00:00

Issue Body:
## Environment
Tue 11 Feb 2025 01:34:43 PM CST
radare2 5.9.9 33286 @ linux-x86-32
birth: git.5.9.8-352-g473664b1e7 2025-02-11__13:11:21
commit: 473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81
options: gpl asan -O? cs:5 cl:2 make

## Description
**cmd**:  `rasm2 -i 6 -E 'mov eax, 30'` 
**expected**: not crash
**actually**: crash
## Test

**1**: compile radare2 with asan option on
**2**: run command  `rasm2 -i 6 -E 'mov eax, 30'` 

 ## ASan log
./bins/bin/rasm2 -i 6  -E 'mov eax, 30'
=================================================================
==1539759==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x556fedbb114c in __asan_memmove (./radare2/bins/bin/rasm2+0xa014c) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)
    #1 0x7fb5c11d72cf in r_main_rasm2 ./radare2/libr/main/rasm2.c:1063:5
    #2 0x556fedbec7a1 in main ./radare2/binr/rasm2/rasm2.c:6:9
    #3 0x7fb5c0f9c082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
    #4 0x556fedb2f31d in _start (./radare2/bins/bin/rasm2+0x1e31d) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)

0x602000009ddc is located 0 bytes to the right of 12-byte region [0x602000009dd0,0x602000009ddc)
allocated by thread T0 here:
    #0 0x556fedb9c4c3 in strdup (./radare2/bins/bin/rasm2+0x8b4c3) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)
    #1 0x7fb5c11d7259 in r_main_rasm2 ./radare2/libr/main/rasm2.c:1059:19
    #2 0x556fedbec7a1 in main ./radare2/binr/rasm2/rasm2.c:6:9
    #3 0x7fb5c0f9c082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: negative-size-param (./radare2/bins/bin/rasm2+0xa014c) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698) in __asan_memmove
==1539759==ABORTING



Commit References:
473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81
c182a69a7b8fb8b422226bca07598a5ba9758698

================= Bug Report (2/2) ==================
## Source: GitHub Issue
## URL: https://github.com/radareorg/radare2/issues/23953#issue-2844325926
## Description:
Issue: radareorg/radare2#23953
Title: rasm2 negative-size-param error in r_main_rasm2
State: closed
Created by: Ekkosun
Created at: 2025-02-11 05:42:20+00:00

Issue Body:
## Environment
Tue 11 Feb 2025 01:34:43 PM CST
radare2 5.9.9 33286 @ linux-x86-32
birth: git.5.9.8-352-g473664b1e7 2025-02-11__13:11:21
commit: 473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81
options: gpl asan -O? cs:5 cl:2 make

## Description
**cmd**:  `rasm2 -i 6 -E 'mov eax, 30'` 
**expected**: not crash
**actually**: crash
## Test

**1**: compile radare2 with asan option on
**2**: run command  `rasm2 -i 6 -E 'mov eax, 30'` 

 ## ASan log
./bins/bin/rasm2 -i 6  -E 'mov eax, 30'
=================================================================
==1539759==ERROR: AddressSanitizer: negative-size-param: (size=-1)
    #0 0x556fedbb114c in __asan_memmove (./radare2/bins/bin/rasm2+0xa014c) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)
    #1 0x7fb5c11d72cf in r_main_rasm2 ./radare2/libr/main/rasm2.c:1063:5
    #2 0x556fedbec7a1 in main ./radare2/binr/rasm2/rasm2.c:6:9
    #3 0x7fb5c0f9c082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16
    #4 0x556fedb2f31d in _start (./radare2/bins/bin/rasm2+0x1e31d) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)

0x602000009ddc is located 0 bytes to the right of 12-byte region [0x602000009dd0,0x602000009ddc)
allocated by thread T0 here:
    #0 0x556fedb9c4c3 in strdup (./radare2/bins/bin/rasm2+0x8b4c3) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698)
    #1 0x7fb5c11d7259 in r_main_rasm2 ./radare2/libr/main/rasm2.c:1059:19
    #2 0x556fedbec7a1 in main ./radare2/binr/rasm2/rasm2.c:6:9
    #3 0x7fb5c0f9c082 in __libc_start_main /build/glibc-FcRMwW/glibc-2.31/csu/../csu/libc-start.c:308:16

SUMMARY: AddressSanitizer: negative-size-param (./radare2/bins/bin/rasm2+0xa014c) (BuildId: c182a69a7b8fb8b422226bca07598a5ba9758698) in __asan_memmove
==1539759==ABORTING



Commit References:
473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81
c182a69a7b8fb8b422226bca07598a5ba9758698

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export USERCC=$CC
export HOST_CC=$CC
export NOLTO=1
export CXXFLAGS="${CXXFLAGS} -I ${RADARE2_STATIC_BUILD}/usr/include/libr/sdb"
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update
RUN apt-get install -y pkg-config wget
RUN git clone https://github.com/radareorg/radare2 radare2
RUN git -C radare2 checkout 473664b1e7fa76bcb72a1cb4f1c01e1e820b7c81
WORKDIR $SRC/radare2
COPY build.sh $SRC/

Additional files:
filename: default.options
content: [libfuzzer]
detect_leaks=0