Project: libsass (sass/libsass), language: c++
Vulnerability instance: libsass.cve-2018-20190
Sanitizer: address

================= Bug Report (1/1) ==================
## Source: GitHub Issue
## URL: https://github.com/sass/libsass/issues/2786
## Description:
Issue: sass/libsass#2786
Title: Null pointer dereference in Sass::Eval::operator()(Sass::Supports_Operator*) eval.cpp
State: closed
Created by: zyingp
Created at: 2018-12-04 05:34:36+00:00
Labels: Dev - Test Written, Bug - Should Error, Fuzzy

Issue Body:
I fuzzed and found another null pointer dereference problem in Sass::Eval::operator()(Sass::Supports_Operator*) eval.cpp. The problem exists in both the 3.5.5 version and the master branch (2018/12/2), with the same crash stack.

Build libsass/sassc with ASan:
`CXX=clang++ CC=clang CFLAGS="-g -fsanitize=address -fno-omit-frame-pointer" CXXFLAGS=$CFLAGS make -C sassc -j4`

Run `./sassc sass_npd` and program crashes.
(sass_npd is at here: https://github.com/zyingp/temp/blob/master/sass_npd)

# Crash stack
Crash stack (of master branch):
```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==42416==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00010832659a bp 0x7ffee7ded890 sp 0x7ffee7ded5e0 T0)
==42416==The signal is caused by a READ memory access.
==42416==Hint: address points to the zero page.
    #0 0x108326599 in Sass::Eval::operator()(Sass::Supports_Operator*) eval.cpp:1326
    #1 0x107e9b3c6 in Sass::Supports_Operator::perform(Sass::Operation<Sass::Value*>*) ast_supports.hpp:73
    #2 0x1083693ed in Sass::Expand::operator()(Sass::Supports_Block*) expand.cpp:162
    #3 0x107e9b073 in Sass::Supports_Block::perform(Sass::Operation<Sass::Value*>*) ast_supports.hpp:45
    #4 0x10836305c in Sass::Expand::append_block(Sass::Block*) expand.cpp:807
    #5 0x108361950 in Sass::Expand::operator()(Sass::Block*) expand.cpp:72
    #6 0x107f82193 in Sass::Context::compile() context.cpp:678
    #7 0x107f7e9bb in Sass::File_Context::parse() context.cpp:605
    #8 0x108589400 in Sass::sass_parse_block(Sass_Compiler*) sass_context.cpp:234
    #9 0x108588b8a in sass_compiler_parse sass_context.cpp:483
    #10 0x1085882f9 in sass_compile_context(Sass_Context*, Sass::Context*) sass_context.cpp:371
    #11 0x10858871d in sass_compile_file_context sass_context.cpp:470
    #12 0x107e10796 in compile_file sassc.c:158
    #13 0x107e110d6 in main sassc.c:370
    #14 0x7fff701cb014 in start (libdyld.dylib:x86_64+0x1014)

==42416==Register values:
rax = 0x0000100000000000  rbx = 0x00007ffee7ded700  rcx = 0x0000000000000000  rdx = 0x0000100000000000  
rdi = 0x00007ffee7ded620  rsi = 0x00007ffee7ded620  rbp = 0x00007ffee7ded890  rsp = 0x00007ffee7ded5e0  
 r8 = 0x00001c18000003ed   r9 = 0x00001c18000003e0  r10 = 0x00001c18000003ed  r11 = 0xffffe0c118215698  
r12 = 0x00007ffee7deed70  r13 = 0x000060d000000450  r14 = 0x00007ffee7deed88  r15 = 0x000060d000000380  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV eval.cpp:1326 in Sass::Eval::operator()(Sass::Supports_Operator*)
==42416==ABORTING
```

It seems that in function `Expression_Ptr Eval::operator()(Supports_Operator_Ptr c)`, the `right` variable (not Null) is casted and becomes a Null `Supports_Condition` SharedObj at line `Cast<Supports_Condition>(right),`.
```C++
  Expression_Ptr Eval::operator()(Supports_Operator_Ptr c)
  {
    Expression_Ptr left = c->left()->perform(this);
    Expression_Ptr right = c->right()->perform(this);
    Supports_Operator_Ptr cc = SASS_MEMORY_NEW(Supports_Operator,
                                 c->pstate(),
                                 Cast<Supports_Condition>(left),
                                 Cast<Supports_Condition>(right),
                                 c->operand());
    return cc;
  }
```


Comments:
Comment by glebm on 2018-12-04 12:48:20+00:00:
Minimal example:

```scss
@supports (foo: bar) or {
}
```

Dart Sass:

```
Error: expected "(".
@supports (foo: bar) or {
                        ^
```

Ruby Sass:

```
sass ~/tmp/npd.scss        
Error: Invalid CSS after "...(foo: bar) or  ": expected @supports condition (e.g. (display: flexbox)), was "{"
```

---

Comment by xi on 2019-06-05 05:35:30+00:00:
Assigned CVE-2018-20190

Build script:
#!/bin/bash -eu
# Minimized build script with only core build commands
set -eu
export BUILD='static'
make -j$(nproc)

Dockerfile:
FROM hwiwonlee/secb.base:latest
RUN apt-get update && apt-get install -y make autoconf automake libtool
RUN git clone https://github.com/sass/libsass libsass
RUN git -C libsass checkout 39e30874b9a5dd6a802c20e8b0470ba44eeba929
WORKDIR $SRC/libsass
COPY build.sh $SRC/

Additional files:
filename: data_context_fuzzer.cc
content: #include "sass.h"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  char* sass_data = (char*) malloc(sizeof(char) * size + 1);
  if (sass_data == NULL) return 0;

  memcpy(sass_data, data, size);
  sass_data[size] = '\0';

  struct Sass_Data_Context* ctx = sass_make_data_context(sass_data);
  if (ctx == NULL) {
    free(sass_data);
    return 0;
  }

  struct Sass_Options* options = sass_make_options();
  if (options == NULL) {
    sass_delete_data_context(ctx);
    return 0;
  }

  sass_option_set_output_style(options, SASS_STYLE_NESTED);
  sass_option_set_precision(options, 5);

  sass_data_context_set_options(ctx, options);
  sass_compile_data_context(ctx);

  sass_delete_data_context(ctx);
  sass_delete_options(options);

  return 0;
}