CVE-2017-9438 (Other, published 2017-06-05T17:29Z)
Description: value: libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/hex_grammar.c
libyara/hex_grammar.h
libyara/hex_grammar.y
Commit message: Fix issue #674 for hex strings.


Vulnerable code:
#line 111 "hex_grammar.c" /* yacc.c:339  */
#line 78 "hex_grammar.y" /* yacc.c:355  */
#line 166 "hex_grammar.c" /* yacc.c:355  */
#line 182 "hex_grammar.c" /* yacc.c:358  */
       0,   105,   105,   114,   118,   127,   189,   193,   206,   210,
     219,   233,   232,   245,   268,   300,   322,   342,   346,   360,
     368
#line 94 "hex_grammar.y" /* yacc.c:1257  */
#line 1023 "hex_grammar.c" /* yacc.c:1257  */
#line 95 "hex_grammar.y" /* yacc.c:1257  */
#line 1029 "hex_grammar.c" /* yacc.c:1257  */
#line 96 "hex_grammar.y" /* yacc.c:1257  */
#line 1035 "hex_grammar.c" /* yacc.c:1257  */
#line 97 "hex_grammar.y" /* yacc.c:1257  */
#line 1041 "hex_grammar.c" /* yacc.c:1257  */
#line 100 "hex_grammar.y" /* yacc.c:1257  */
#line 1047 "hex_grammar.c" /* yacc.c:1257  */
#line 99 "hex_grammar.y" /* yacc.c:1257  */
#line 1053 "hex_grammar.c" /* yacc.c:1257  */
#line 98 "hex_grammar.y" /* yacc.c:1257  */
#line 1059 "hex_grammar.c" /* yacc.c:1257  */
#line 106 "hex_grammar.y" /* yacc.c:1646  */
#line 1330 "hex_grammar.c" /* yacc.c:1646  */
#line 115 "hex_grammar.y" /* yacc.c:1646  */
#line 1338 "hex_grammar.c" /* yacc.c:1646  */
#line 119 "hex_grammar.y" /* yacc.c:1646  */
#line 1351 "hex_grammar.c" /* yacc.c:1646  */
#line 128 "hex_grammar.y" /* yacc.c:1646  */
#line 1413 "hex_grammar.c" /* yacc.c:1646  */
#line 190 "hex_grammar.y" /* yacc.c:1646  */
#line 1421 "hex_grammar.c" /* yacc.c:1646  */
#line 194 "hex_grammar.y" /* yacc.c:1646  */
#line 1434 "hex_grammar.c" /* yacc.c:1646  */
#line 207 "hex_grammar.y" /* yacc.c:1646  */
#line 1442 "hex_grammar.c" /* yacc.c:1646  */
#line 211 "hex_grammar.y" /* yacc.c:1646  */
#line 1451 "hex_grammar.c" /* yacc.c:1646  */
#line 220 "hex_grammar.y" /* yacc.c:1646  */
#line 1468 "hex_grammar.c" /* yacc.c:1646  */
#line 233 "hex_grammar.y" /* yacc.c:1646  */
#line 1476 "hex_grammar.c" /* yacc.c:1646  */
#line 237 "hex_grammar.y" /* yacc.c:1646  */
#line 1485 "hex_grammar.c" /* yacc.c:1646  */
#line 246 "hex_grammar.y" /* yacc.c:1646  */
#line 1512 "hex_grammar.c" /* yacc.c:1646  */
#line 269 "hex_grammar.y" /* yacc.c:1646  */
#line 1548 "hex_grammar.c" /* yacc.c:1646  */
#line 301 "hex_grammar.y" /* yacc.c:1646  */
#line 1574 "hex_grammar.c" /* yacc.c:1646  */
#line 323 "hex_grammar.y" /* yacc.c:1646  */
#line 1594 "hex_grammar.c" /* yacc.c:1646  */
#line 343 "hex_grammar.y" /* yacc.c:1646  */
#line 1602 "hex_grammar.c" /* yacc.c:1646  */
#line 347 "hex_grammar.y" /* yacc.c:1646  */
#line 1617 "hex_grammar.c" /* yacc.c:1646  */
#line 361 "hex_grammar.y" /* yacc.c:1646  */
#line 1629 "hex_grammar.c" /* yacc.c:1646  */
#line 369 "hex_grammar.y" /* yacc.c:1646  */
#line 1653 "hex_grammar.c" /* yacc.c:1646  */
#line 1657 "hex_grammar.c" /* yacc.c:1646  */
#line 390 "hex_grammar.y" /* yacc.c:1906  */
#line 78 "hex_grammar.y" /* yacc.c:1909  */
#line 69 "hex_grammar.h" /* yacc.c:1909  */

Fixed code:
#define incr_ast_levels() \
    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
    { \
      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
      YYABORT; \
    }

#line 118 "hex_grammar.c" /* yacc.c:339  */
#line 85 "hex_grammar.y" /* yacc.c:355  */
#line 173 "hex_grammar.c" /* yacc.c:355  */
#line 189 "hex_grammar.c" /* yacc.c:358  */
       0,   112,   112,   121,   125,   136,   200,   204,   219,   223,
     232,   246,   245,   258,   281,   313,   335,   355,   359,   374,
     382
#line 101 "hex_grammar.y" /* yacc.c:1257  */
#line 1030 "hex_grammar.c" /* yacc.c:1257  */
#line 102 "hex_grammar.y" /* yacc.c:1257  */
#line 1036 "hex_grammar.c" /* yacc.c:1257  */
#line 103 "hex_grammar.y" /* yacc.c:1257  */
#line 1042 "hex_grammar.c" /* yacc.c:1257  */
#line 104 "hex_grammar.y" /* yacc.c:1257  */
#line 1048 "hex_grammar.c" /* yacc.c:1257  */
#line 107 "hex_grammar.y" /* yacc.c:1257  */
#line 1054 "hex_grammar.c" /* yacc.c:1257  */
#line 106 "hex_grammar.y" /* yacc.c:1257  */
#line 1060 "hex_grammar.c" /* yacc.c:1257  */
#line 105 "hex_grammar.y" /* yacc.c:1257  */
#line 1066 "hex_grammar.c" /* yacc.c:1257  */
#line 113 "hex_grammar.y" /* yacc.c:1661  */
#line 1337 "hex_grammar.c" /* yacc.c:1661  */
#line 122 "hex_grammar.y" /* yacc.c:1661  */
#line 1345 "hex_grammar.c" /* yacc.c:1661  */
#line 126 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1360 "hex_grammar.c" /* yacc.c:1661  */
#line 137 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1424 "hex_grammar.c" /* yacc.c:1661  */
#line 201 "hex_grammar.y" /* yacc.c:1661  */
#line 1432 "hex_grammar.c" /* yacc.c:1661  */
#line 205 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();

#line 1447 "hex_grammar.c" /* yacc.c:1661  */
#line 220 "hex_grammar.y" /* yacc.c:1661  */
#line 1455 "hex_grammar.c" /* yacc.c:1661  */
#line 224 "hex_grammar.y" /* yacc.c:1661  */
#line 1464 "hex_grammar.c" /* yacc.c:1661  */
#line 233 "hex_grammar.y" /* yacc.c:1661  */
#line 1481 "hex_grammar.c" /* yacc.c:1661  */
#line 246 "hex_grammar.y" /* yacc.c:1661  */
#line 1489 "hex_grammar.c" /* yacc.c:1661  */
#line 250 "hex_grammar.y" /* yacc.c:1661  */
#line 1498 "hex_grammar.c" /* yacc.c:1661  */
#line 259 "hex_grammar.y" /* yacc.c:1661  */
#line 1525 "hex_grammar.c" /* yacc.c:1661  */
#line 282 "hex_grammar.y" /* yacc.c:1661  */
#line 1561 "hex_grammar.c" /* yacc.c:1661  */
#line 314 "hex_grammar.y" /* yacc.c:1661  */
#line 1587 "hex_grammar.c" /* yacc.c:1661  */
#line 336 "hex_grammar.y" /* yacc.c:1661  */
#line 1607 "hex_grammar.c" /* yacc.c:1661  */
#line 356 "hex_grammar.y" /* yacc.c:1661  */
#line 1615 "hex_grammar.c" /* yacc.c:1661  */
#line 360 "hex_grammar.y" /* yacc.c:1661  */
        incr_ast_levels();
#line 1631 "hex_grammar.c" /* yacc.c:1661  */
#line 375 "hex_grammar.y" /* yacc.c:1661  */
#line 1643 "hex_grammar.c" /* yacc.c:1661  */
#line 383 "hex_grammar.y" /* yacc.c:1661  */
#line 1667 "hex_grammar.c" /* yacc.c:1661  */
#line 1671 "hex_grammar.c" /* yacc.c:1661  */
#line 404 "hex_grammar.y" /* yacc.c:1906  */
#line 85 "hex_grammar.y" /* yacc.c:1915  */
#line 69 "hex_grammar.h" /* yacc.c:1915  */
#define incr_ast_levels() \
    if (((RE_AST*) yyget_extra(yyscanner))->levels++ > RE_MAX_AST_LEVELS) \
    { \
      lex_env->last_error_code = ERROR_INVALID_HEX_STRING; \
      YYABORT; \
    }

        incr_ast_levels();

        incr_ast_levels();

        incr_ast_levels();

        incr_ast_levels();