Project: libass (libass/libass), language: c++
Vulnerability instance: libass.cve-2020-24994
Sanitizer: address

================= Bug Report (1/3) ==================
## Source: GitHub Issue
## URL: https://github.com/libass/libass/issues/422
## Description:
Issue: libass/libass#422
Title: stack-overflow on ass_parse.c:234 *parse_tag
State: closed
Created by: Fstark-prog
Created at: 2020-08-27 02:18:39+00:00

Issue Body:
**Description**
A vulnerability was found in function parse_tag in ass_parse.c:234 ,which allow attackers to cause a denial of service or remote code execution via a crafted file.


test@test:~/libass-0.14.0/afl$ ./a.out crash/poc 
======================= INFO =========================
This binary is built for AFL-fuzz.
To run the target function on individual input(s) execute this:
  ./a.out < INPUT_FILE
or
  ./a.out INPUT_FILE1 [INPUT_FILE2 ... ]
To fuzz with afl-fuzz execute this:
  afl-fuzz [afl-flags] ./a.out [-N]
```
afl-fuzz will run N iterations before re-spawning the process (default: 1000)
======================================================

Reading 50635 bytes from crash/poc

ASAN:DEADLYSIGNAL
=================================================================

==64283==ERROR: AddressSanitizer: stack-overflow on address 0x7fff99b2bff8 (pc 0x00000046724b bp 0x7fff99b2fcf0 sp 0x7fff99b2c000 T0)
    #0 0x46724a in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:234
    #1 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #2 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #3 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #4 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #5 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #6 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #7 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #8 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #9 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #10 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #11 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #12 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #13 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #14 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #15 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #16 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #17 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #18 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #19 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #20 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #21 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #22 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #23 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #24 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #25 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #26 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #27 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #28 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #29 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #30 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #31 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #32 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #33 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #34 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #35 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #36 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #37 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #38 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #39 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #40 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #41 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #42 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #43 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #44 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #45 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #46 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #47 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #48 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #49 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #50 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #51 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #52 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #53 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #54 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #55 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #56 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #57 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #58 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #59 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #60 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #61 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #62 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #63 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #64 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #65 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #66 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #67 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #68 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #69 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #70 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #71 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #72 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #73 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #74 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #75 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #76 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #77 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #78 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #79 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #80 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #81 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #82 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #83 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #84 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #85 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #86 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #87 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #88 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #89 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #90 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #91 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #92 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #93 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #94 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #95 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #96 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #97 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #98 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #99 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #100 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #101 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #102 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #103 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #104 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #105 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #106 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #107 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #108 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #109 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #110 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #111 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #112 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #113 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #114 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #115 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #116 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #117 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #118 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #119 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #120 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #121 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #122 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #123 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #124 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #125 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #126 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #127 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #128 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #129 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #130 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #131 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #132 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #133 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #134 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #135 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #136 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #137 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #138 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #139 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #140 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #141 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #142 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #143 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #144 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #145 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #146 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #147 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #148 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #149 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #150 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #151 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #152 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #153 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #154 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #155 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #156 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #157 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #158 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #159 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #160 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #161 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #162 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #163 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #164 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #165 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #166 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #167 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #168 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #169 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #170 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #171 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #172 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #173 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #174 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #175 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #176 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #177 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #178 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #179 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #180 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #181 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #182 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #183 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #184 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #185 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #186 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #187 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #188 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #189 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #190 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #191 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #192 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #193 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #194 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #195 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #196 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #197 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #198 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #199 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #200 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #201 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #202 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #203 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #204 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #205 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #206 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #207 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #208 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #209 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #210 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #211 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #212 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #213 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #214 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #215 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #216 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #217 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #218 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #219 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #220 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #221 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #222 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #223 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #224 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #225 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #226 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #227 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #228 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #229 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #230 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #231 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #232 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #233 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #234 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #235 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #236 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #237 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #238 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #239 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #240 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #241 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #242 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #243 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #244 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #245 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #246 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #247 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #248 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #249 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654
    #250 0x4737a1 in parse_tag /home/test/libass-0.14.0/libass/ass_parse.c:654

SUMMARY: AddressSanitizer: stack-overflow /home/test/libass-0.14.0/libass/ass_parse.c:234 in parse_tag
==64283==ABORTING
```


Comments:
Comment by astiob on 2020-08-27 20:20:54+00:00:
I believe this is already fixed in the master branch (ironically, in one of the very first commits after the 0.14.0 release that you’re testing, namely 6835731c2fe4164a0c50bc91d12c43b2a2b4e799, part of #296). Could you confirm this by building your libass from master?

We do need to make a new release though.

---

Comment by stevebeattie on 2021-03-24 06:37:25+00:00:
This issue was assigned [CVE-2020-24994](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24994).

---

Comment by TheOneric on 2021-03-24 17:08:45+00:00:
@stevebeattie: Hi, thanks for letting us know. I believe the description of this CVE is wrong; it states *(emphasis mine)*: “Stack overflow in the parse_tag function in libass/ass_parse.c in libass **before** 0.14.0”, but 6835731 only landed **after** 0.14.0 was released.

---

Comment by stevebeattie on 2021-04-17 04:44:53+00:00:
@TheOneric thanks, I've submitted correction information to MITRE, we'll see how long it takes them to update it.

(In an ideal world, you'd be able to file a github issue directly against https://github.com/CVEProject/cvelist but they don't allow bug reports on the project.)

---

Comment by stevebeattie on 2021-04-20 01:05:07+00:00:
FYI, [CVE-2020-24994](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24994) has corrected information. Thanks.

Commit References:
6835731c2fe4164a0c50bc91d12c43b2a2b4e799

================= Bug Report (2/3) ==================
## Source: GitHub Issue
## URL: https://github.com/libass/libass/issues/422#issuecomment-806002919
## Description:
Issue: libass/libass#422
Title: stack-overflow on ass_parse.c:234 *parse_tag
Referenced comment by TheOneric on 2021-03-24 17:08:45+00:00:

@stevebeattie: Hi, thanks for letting us know. I believe the description of this CVE is wrong; it states *(emphasis mine)*: “Stack overflow in the parse_tag function in libass/ass_parse.c in libass **before** 0.14.0”, but 6835731 only landed **after** 0.14.0 was released.

================= Bug Report (3/3) ==================
## Source: GitHub Issue
## URL: https://github.com/libass/libass/issues/423
## Description:
Issue: libass/libass#423
Title: stack-overflow on ass_parse.c:77 mystrcmp
State: closed
Created by: Fstark-prog
Created at: 2020-08-29 07:31:47+00:00

Issue Body:
**Description**
A vulnerability was found in function mystrcmp in ass_parse.c:77 ,which allow attackers to cause a denial of service or remote code execution via a crafted file.


Comments:
Comment by TheOneric on 2020-09-02 22:30:15+00:00:
Thanks for taking your time to fuzz libass.
I can't find `mystrcmp` anywhere in the stacktrace, it seems to point towards the same problem as #422 , perhaps you mixed the stacktraces up? Did you fuzz against git-master or still 0.14.0 ?
Also the `poc.zip` archive seems to be broken, so unfortunately I can't try to reproduce it myself and it isn't obvious to me how `mystrcmp` can be exploited either.
```
Archive:  poc.zip
  End-of-central-directory signature not found.  Either this file is not
  a zipfile, or it constitutes one disk of a multi-part archive.
```

Incidentially `mystrcmp` was modified a few days ago in b3f9022b04ddf8872b99c28dd358d89e94dea12d, could you retest and/or reupload the sample file ?

---

Comment by TheOneric on 2020-09-03 23:27:53+00:00:
Ok, I've tested the file from the RAR archive with master and 0.14.0. In both cases I couldn't reproduce any overflows or similar.

Can you  provide exact steps how to reproduce this? Which program consumes the sample file? Which OS, libc and CPU architecture? Which exact version of libass is being used?

---

Comment by astiob on 2020-09-19 15:05:18+00:00:
Unless the OP posted a wrong stack trace by accident, I’m pretty sure this is the same as #422 and is long fixed in master.

It’s great to have more people fuzz libass, but _please_ run your tests against master!

Commit References:
b3f9022b04ddf8872b99c28dd358d89e94dea12d

Build script:
#!/bin/bash -eux
# Minimized build script with only core build commands
set -eu
cd $SRC/fribidi
./bootstrap
./configure --enable-static=yes --enable-shared=no --with-pic=yes --prefix=/work/
make install -j$(nproc)
cd $SRC/libass
export PKG_CONFIG_PATH=/work/lib/pkgconfig
./autogen.sh
./configure --disable-asm
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool pkg-config libfreetype6-dev libfontconfig1-dev
RUN git clone https://github.com/libass/libass libass
RUN git -C libass checkout 691b422247552a86e9d3310c4f1ea096dc52a3f2
WORKDIR $SRC/libass
COPY build.sh $SRC/

Additional files:
filename: ass.dict
content: "0x"
"\\1a"
"\\2a"
"\\2c"
"\\3a"
"\\3c"
"\\4a"
"\\4c"
"\\a"
"\\alpha"
"\\an"
"Arial"
"\\b"
"Banner;"
"\\be"
"\\blur"
"\\bord"
"\\c"
"CFF"
"CID Type 1"
"\\clip"
"clip"
"Courier"
"Courier New"
"Default"
"Dialogue:"
"[Events]"
"\\fade"
"\\fax"
"\\fay"
"\\fe"
"\\fn"
"fontname:"
"[Fonts]"
"Format:"
"\\frx"
"\\fry"
"\\frz"
"\\fs"
"\\fsc"
"\\fscx"
"\\fscy"
"\\fsp"
"&h"
"Helvetica"
"\\i"
"\\iclip"
"iclip"
"\\k"
"Kerning:"
"Kerning"
"\\kf"
"\\ko"
"Language:"
"monospace"
"\\move"
"move"
"none"
"\\org"
"org"
"OverrideStyle"
"\\p"
"p"
"\\pbo"
"pbo"
"pc.240m"
"pc.601"
"pc.709"
"pc.fcc"
"PlayResX:"
"PlayResX"
"PlayResY:"
"PlayResY"
"\\pos"
"pos"
"\\q"
"\\r"
"\\s"
"sans-serif"
"ScaledBorderAndShadow:"
"ScaledBorderAndShadow"
"[Script Info]"
"Scroll down;"
"Scroll up;"
"serif"
"\\shad"
"Style:"
"\\t"
"Text"
"Timer:"
"Timer"
"Times"
"Times New Roman"
"tv.240m"
"tv.601"
"tv.709"
"tv.fcc"
"Type 1"
"Type 42"
"\\u"
"UTF-8"
"[V4 Styles]"
"[V4+ Styles]"
"WrapStyle:"
"WrapStyle"
"\\xbord"
"\\xshad"
"\\ybord"
"YCbCr Matrix:"
"YCbCr Matrix"
"yes"
"\\yshad"

filename: libass_fuzzer.cc
content: #include <stdio.h>
#include <stdlib.h>

#include <libass/ass.h>

static ASS_Library *ass_library;
static ASS_Renderer *ass_renderer;

void msg_callback(int level, const char *fmt, va_list va, void *data) {
}

static const int kFrameWidth = 1280;
static const int kFrameHeight = 720;

static bool init(int frame_w, int frame_h) {
  ass_library = ass_library_init();
  if (!ass_library) {
    printf("ass_library_init failed!\n");
    exit(1);
  }

  ass_set_message_cb(ass_library, msg_callback, NULL);

  ass_renderer = ass_renderer_init(ass_library);
  if (!ass_renderer) {
    printf("ass_renderer_init failed!\n");
    exit(1);
  }

  ass_set_frame_size(ass_renderer, frame_w, frame_h);
  ass_set_fonts(ass_renderer, nullptr, "sans-serif",
                ASS_FONTPROVIDER_AUTODETECT, nullptr, 1);
  return true;
}

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  static bool initialized = init(kFrameWidth, kFrameHeight);

  ASS_Track *track = ass_read_memory(ass_library, (char *)data, size, nullptr);
  if (!track) return 0;

  for (int i = 0; i < track->n_events; ++i) {
    ASS_Event &ev = track->events[i];
    long long tm = ev.Start + ev.Duration / 2;
    ass_render_frame(ass_renderer, track, tm, nullptr);
  }
  ass_free_track(track);
  return 0;
}

filename: libass_fuzzer.options
content: [libfuzzer]
dict = ass.dict