Project: libyang (cesnet/libyang), language: c++
Vulnerability instance: libyang.cve-2023-26917
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/CESNET/libyang/issues/1987
## Description:
Issue: CESNET/libyang#1987
Title: `lysp_stmt_validate_value`: NULL pointer dereference via `lys_parse_mem`
State: closed
Created by: thonsun
Created at: 2023-02-25 14:09:15+00:00
Labels: is:bug, status:completed

Issue Body:
Hello, I find a null pointer derefence error in `lysp_stmt_validate_value()` when I try to fuzz libyang via `lys_parse_mem.c `. In function `lysp_stmt_validate_value()`, it doesn't check whether the value of `val` is NULL. In some cases, it can be NULL, which leads to the operation of `while ( *val )` in line 390 that results in a crash:

```shell
Running: crash-4f8d352eaeecedd6c288232cd8b5218c8ac2ad92
AddressSanitizer:DEADLYSIGNAL
=================================================================
==563664==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000007566c7 bp 0x7ffdc60bc650 sp 0x7ffdc60bc440 T0)
==563664==The signal is caused by a READ memory access.
==563664==Hint: address points to the zero page.
    #0 0x7566c7 in lysp_stmt_validate_value /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:390:5
    #1 0x730aa9 in lysp_stmt_type_enum /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:996:5
    #2 0x750021 in lysp_stmt_type /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:1789:13
    #3 0x7128a6 in lysp_stmt_parse /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:3394:15
    #4 0x70f50a in lys_parse_ext_instance_stmt /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:3520:9
    #5 0x82d61f in lyplg_ext_parse_extension_instance /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/plugins_exts.c:70:23
    #6 0x835a28 in annotation_parse /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/plugins_exts/metadata.c:104:14
    #7 0x6c9118 in lysp_resolve_ext_instance_records /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/tree_schema.c:1331:17
    #8 0x6c02c2 in lys_parse_in /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/tree_schema.c:1826:5
    #9 0x6c9729 in lys_parse /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/tree_schema.c:1913:11
    #10 0x6c9e9f in lys_parse_mem /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/tree_schema.c:1951:11
    #11 0x54f3e1 in LLVMFuzzerTestOneInput (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x54f3e1)
    #12 0x4587d1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x4587d1)
    #13 0x443ee2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x443ee2)
    #14 0x449f4e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x449f4e)
    #15 0x471a12 in main (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x471a12)
    #16 0x7f05c0973082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #17 0x41e5ed in _start (/home/thonsun/Fuzz-Codehub/libyang-2.1.30/tests/fuzz/libfuzzer_lys_parse_yang+0x41e5ed)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:390:5 in lysp_stmt_validate_value
==563664==ABORTING
```

And a gdb debug details:

```shell
Breakpoint 3, lysp_stmt_type_enum (ctx=0x608000006220, stmt=0x606000012bc0, enums=0x60b000011208)
    at /home/thonsun/Fuzz-Codehub/libyang-2.1.30/src/parser_common.c:996
996         LY_CHECK_RET(lysp_stmt_validate_value(ctx, stmt->kw == LY_STMT_ENUM ? Y_STR_ARG : Y_IDENTIF_ARG, stmt->arg));
(gdb) p *stmt
$7 = {
  stmt = 0x602000002d70 "bit",
  arg = 0x0, <= here call to lysp_stmt_validate_value 
  format = LY_VALUE_SCHEMA,
  prefix_data = 0x60c000010240,
  next = 0x606000012c80,
  child = 0x606000012c20,
  flags = 0,
  kw = LY_STMT_BIT
}
(gdb) 
```



Comments:
Comment by michalvasko on 2023-02-27 08:30:42+00:00:
Seems possible and should now be fixed but please include the input causing the problem, too, next time.

---

Comment by thonsun on 2023-04-02 08:45:27+00:00:
Oh, you can download the target input from `https://github.com/thonsun/fuzz-workspace`, including [issue 1979](https://github.com/CESNET/libyang/issues/1979)

---

Comment by abergmann on 2023-04-11 15:30:46+00:00:
[CVE-2023-26917](https://nvd.nist.gov/vuln/detail/CVE-2023-26917) was assigned to this issue.

Commit References:
4f8d352eaeecedd6c288232cd8b5218c8ac2ad92

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
sed -i 's/add_subdirectory/#add_subdirectory/g' ./tools/CMakeLists.txt
mkdir -p build && cd build
cmake ../ -DENABLE_STATIC=ON
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y autoconf automake libtool subversion
RUN git clone https://github.com/cesnet/libyang libyang
RUN git -C libyang checkout a0cc89516ab5eca84d01c85309f320a94752a64c
WORKDIR $SRC/libyang
COPY build.sh $SRC/

Additional files: