CVE-2017-5923 (Other, published 2017-04-03T05:59Z)
Description: value: libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/VirusTotal/yara
Files changed:
libyara/grammar.c
libyara/grammar.y
Commit message: Fix issue #597


Vulnerable code:
     802,   806,   831,   867,   913,   935,   944,   953,   968,   980,
     994,  1007,  1018,  1027,  1057,  1026,  1171,  1170,  1249,  1255,
    1262,  1261,  1324,  1323,  1384,  1393,  1402,  1411,  1420,  1429,
    1438,  1442,  1450,  1451,  1456,  1478,  1490,  1506,  1505,  1511,
    1522,  1523,  1528,  1535,  1546,  1547,  1551,  1559,  1563,  1573,
    1587,  1603,  1613,  1622,  1647,  1659,  1671,  1687,  1699,  1715,
    1760,  1779,  1797,  1815,  1833,  1859,  1877,  1887,  1897,  1907,
    1917,  1927,  1937
#line 2369 "grammar.c" /* yacc.c:1646  */
#line 832 "grammar.y" /* yacc.c:1646  */
#line 2405 "grammar.c" /* yacc.c:1646  */
#line 868 "grammar.y" /* yacc.c:1646  */
#line 2451 "grammar.c" /* yacc.c:1646  */
#line 914 "grammar.y" /* yacc.c:1646  */
#line 2474 "grammar.c" /* yacc.c:1646  */
#line 936 "grammar.y" /* yacc.c:1646  */
#line 2487 "grammar.c" /* yacc.c:1646  */
#line 945 "grammar.y" /* yacc.c:1646  */
#line 2500 "grammar.c" /* yacc.c:1646  */
#line 954 "grammar.y" /* yacc.c:1646  */
#line 2519 "grammar.c" /* yacc.c:1646  */
#line 969 "grammar.y" /* yacc.c:1646  */
#line 2535 "grammar.c" /* yacc.c:1646  */
#line 981 "grammar.y" /* yacc.c:1646  */
#line 2553 "grammar.c" /* yacc.c:1646  */
#line 995 "grammar.y" /* yacc.c:1646  */
#line 2570 "grammar.c" /* yacc.c:1646  */
#line 1008 "grammar.y" /* yacc.c:1646  */
#line 2585 "grammar.c" /* yacc.c:1646  */
#line 1019 "grammar.y" /* yacc.c:1646  */
#line 2597 "grammar.c" /* yacc.c:1646  */
#line 1027 "grammar.y" /* yacc.c:1646  */
#line 2631 "grammar.c" /* yacc.c:1646  */
#line 1057 "grammar.y" /* yacc.c:1646  */
#line 2670 "grammar.c" /* yacc.c:1646  */
#line 1092 "grammar.y" /* yacc.c:1646  */
#line 2753 "grammar.c" /* yacc.c:1646  */
#line 1171 "grammar.y" /* yacc.c:1646  */
#line 2787 "grammar.c" /* yacc.c:1646  */
#line 1201 "grammar.y" /* yacc.c:1646  */
#line 2840 "grammar.c" /* yacc.c:1646  */
#line 1250 "grammar.y" /* yacc.c:1646  */
#line 2850 "grammar.c" /* yacc.c:1646  */
#line 1256 "grammar.y" /* yacc.c:1646  */
#line 2860 "grammar.c" /* yacc.c:1646  */
#line 1262 "grammar.y" /* yacc.c:1646  */
#line 2890 "grammar.c" /* yacc.c:1646  */
#line 1288 "grammar.y" /* yacc.c:1646  */
#line 2930 "grammar.c" /* yacc.c:1646  */
#line 1324 "grammar.y" /* yacc.c:1646  */
#line 2959 "grammar.c" /* yacc.c:1646  */
#line 1349 "grammar.y" /* yacc.c:1646  */
#line 2999 "grammar.c" /* yacc.c:1646  */
#line 1385 "grammar.y" /* yacc.c:1646  */
#line 3012 "grammar.c" /* yacc.c:1646  */
#line 1394 "grammar.y" /* yacc.c:1646  */
#line 3025 "grammar.c" /* yacc.c:1646  */
#line 1403 "grammar.y" /* yacc.c:1646  */
#line 3038 "grammar.c" /* yacc.c:1646  */
#line 1412 "grammar.y" /* yacc.c:1646  */
#line 3051 "grammar.c" /* yacc.c:1646  */
#line 1421 "grammar.y" /* yacc.c:1646  */
#line 3064 "grammar.c" /* yacc.c:1646  */
#line 1430 "grammar.y" /* yacc.c:1646  */
#line 3077 "grammar.c" /* yacc.c:1646  */
#line 1439 "grammar.y" /* yacc.c:1646  */
#line 3085 "grammar.c" /* yacc.c:1646  */
#line 1443 "grammar.y" /* yacc.c:1646  */
#line 3093 "grammar.c" /* yacc.c:1646  */
#line 1450 "grammar.y" /* yacc.c:1646  */
#line 3099 "grammar.c" /* yacc.c:1646  */
#line 1451 "grammar.y" /* yacc.c:1646  */
#line 3105 "grammar.c" /* yacc.c:1646  */
#line 1457 "grammar.y" /* yacc.c:1646  */
#line 3127 "grammar.c" /* yacc.c:1646  */
#line 1479 "grammar.y" /* yacc.c:1646  */
#line 3143 "grammar.c" /* yacc.c:1646  */
#line 1491 "grammar.y" /* yacc.c:1646  */
#line 3158 "grammar.c" /* yacc.c:1646  */
#line 1506 "grammar.y" /* yacc.c:1646  */
#line 3167 "grammar.c" /* yacc.c:1646  */
#line 1512 "grammar.y" /* yacc.c:1646  */
#line 3178 "grammar.c" /* yacc.c:1646  */
#line 1529 "grammar.y" /* yacc.c:1646  */
#line 3189 "grammar.c" /* yacc.c:1646  */
#line 1536 "grammar.y" /* yacc.c:1646  */
#line 3200 "grammar.c" /* yacc.c:1646  */
#line 1548 "grammar.y" /* yacc.c:1646  */
#line 3208 "grammar.c" /* yacc.c:1646  */
#line 1552 "grammar.y" /* yacc.c:1646  */
#line 3216 "grammar.c" /* yacc.c:1646  */
#line 1560 "grammar.y" /* yacc.c:1646  */
#line 3224 "grammar.c" /* yacc.c:1646  */
#line 1564 "grammar.y" /* yacc.c:1646  */
#line 3238 "grammar.c" /* yacc.c:1646  */
#line 1574 "grammar.y" /* yacc.c:1646  */
#line 3256 "grammar.c" /* yacc.c:1646  */
#line 1588 "grammar.y" /* yacc.c:1646  */
#line 3276 "grammar.c" /* yacc.c:1646  */
#line 1604 "grammar.y" /* yacc.c:1646  */
#line 3290 "grammar.c" /* yacc.c:1646  */
#line 1614 "grammar.y" /* yacc.c:1646  */
#line 3303 "grammar.c" /* yacc.c:1646  */
#line 1623 "grammar.y" /* yacc.c:1646  */
#line 3332 "grammar.c" /* yacc.c:1646  */
#line 1648 "grammar.y" /* yacc.c:1646  */
#line 3348 "grammar.c" /* yacc.c:1646  */
#line 1660 "grammar.y" /* yacc.c:1646  */
#line 3364 "grammar.c" /* yacc.c:1646  */
#line 1672 "grammar.y" /* yacc.c:1646  */
#line 3384 "grammar.c" /* yacc.c:1646  */
#line 1688 "grammar.y" /* yacc.c:1646  */
#line 3400 "grammar.c" /* yacc.c:1646  */
#line 1700 "grammar.y" /* yacc.c:1646  */
#line 3420 "grammar.c" /* yacc.c:1646  */
#line 1716 "grammar.y" /* yacc.c:1646  */
#line 3469 "grammar.c" /* yacc.c:1646  */
#line 1761 "grammar.y" /* yacc.c:1646  */
#line 3492 "grammar.c" /* yacc.c:1646  */
#line 1780 "grammar.y" /* yacc.c:1646  */
#line 3514 "grammar.c" /* yacc.c:1646  */
#line 1798 "grammar.y" /* yacc.c:1646  */
#line 3536 "grammar.c" /* yacc.c:1646  */
#line 1816 "grammar.y" /* yacc.c:1646  */
#line 3558 "grammar.c" /* yacc.c:1646  */
#line 1834 "grammar.y" /* yacc.c:1646  */
#line 3588 "grammar.c" /* yacc.c:1646  */
#line 1860 "grammar.y" /* yacc.c:1646  */
#line 3610 "grammar.c" /* yacc.c:1646  */
#line 1878 "grammar.y" /* yacc.c:1646  */
#line 3624 "grammar.c" /* yacc.c:1646  */
#line 1888 "grammar.y" /* yacc.c:1646  */
#line 3638 "grammar.c" /* yacc.c:1646  */
#line 1898 "grammar.y" /* yacc.c:1646  */
#line 3652 "grammar.c" /* yacc.c:1646  */
#line 1908 "grammar.y" /* yacc.c:1646  */
#line 3666 "grammar.c" /* yacc.c:1646  */
#line 1918 "grammar.y" /* yacc.c:1646  */
#line 3680 "grammar.c" /* yacc.c:1646  */
#line 1928 "grammar.y" /* yacc.c:1646  */
#line 3694 "grammar.c" /* yacc.c:1646  */
#line 1938 "grammar.y" /* yacc.c:1646  */
#line 3702 "grammar.c" /* yacc.c:1646  */
#line 3706 "grammar.c" /* yacc.c:1646  */
#line 1943 "grammar.y" /* yacc.c:1906  */

Fixed code:
     802,   806,   833,   871,   917,   939,   948,   957,   972,   984,
     998,  1011,  1022,  1033,  1063,  1032,  1177,  1176,  1255,  1261,
    1268,  1267,  1330,  1329,  1390,  1399,  1408,  1417,  1426,  1435,
    1444,  1448,  1456,  1457,  1462,  1484,  1496,  1512,  1511,  1517,
    1528,  1529,  1534,  1541,  1552,  1553,  1557,  1565,  1569,  1579,
    1593,  1609,  1619,  1628,  1653,  1665,  1677,  1693,  1705,  1721,
    1766,  1785,  1803,  1821,  1839,  1865,  1883,  1893,  1903,  1913,
    1923,  1933,  1943
          default:
            assert(FALSE);
#line 2371 "grammar.c" /* yacc.c:1646  */
#line 834 "grammar.y" /* yacc.c:1646  */
            default:
              assert(FALSE);
#line 2409 "grammar.c" /* yacc.c:1646  */
#line 872 "grammar.y" /* yacc.c:1646  */
#line 2455 "grammar.c" /* yacc.c:1646  */
#line 918 "grammar.y" /* yacc.c:1646  */
#line 2478 "grammar.c" /* yacc.c:1646  */
#line 940 "grammar.y" /* yacc.c:1646  */
#line 2491 "grammar.c" /* yacc.c:1646  */
#line 949 "grammar.y" /* yacc.c:1646  */
#line 2504 "grammar.c" /* yacc.c:1646  */
#line 958 "grammar.y" /* yacc.c:1646  */
#line 2523 "grammar.c" /* yacc.c:1646  */
#line 973 "grammar.y" /* yacc.c:1646  */
#line 2539 "grammar.c" /* yacc.c:1646  */
#line 985 "grammar.y" /* yacc.c:1646  */
#line 2557 "grammar.c" /* yacc.c:1646  */
#line 999 "grammar.y" /* yacc.c:1646  */
#line 2574 "grammar.c" /* yacc.c:1646  */
#line 1012 "grammar.y" /* yacc.c:1646  */
#line 2589 "grammar.c" /* yacc.c:1646  */
#line 1023 "grammar.y" /* yacc.c:1646  */

        YYERROR;
#line 2603 "grammar.c" /* yacc.c:1646  */
#line 1033 "grammar.y" /* yacc.c:1646  */
#line 2637 "grammar.c" /* yacc.c:1646  */
#line 1063 "grammar.y" /* yacc.c:1646  */
#line 2676 "grammar.c" /* yacc.c:1646  */
#line 1098 "grammar.y" /* yacc.c:1646  */
#line 2759 "grammar.c" /* yacc.c:1646  */
#line 1177 "grammar.y" /* yacc.c:1646  */
#line 2793 "grammar.c" /* yacc.c:1646  */
#line 1207 "grammar.y" /* yacc.c:1646  */
#line 2846 "grammar.c" /* yacc.c:1646  */
#line 1256 "grammar.y" /* yacc.c:1646  */
#line 2856 "grammar.c" /* yacc.c:1646  */
#line 1262 "grammar.y" /* yacc.c:1646  */
#line 2866 "grammar.c" /* yacc.c:1646  */
#line 1268 "grammar.y" /* yacc.c:1646  */
#line 2896 "grammar.c" /* yacc.c:1646  */
#line 1294 "grammar.y" /* yacc.c:1646  */
#line 2936 "grammar.c" /* yacc.c:1646  */
#line 1330 "grammar.y" /* yacc.c:1646  */
#line 2965 "grammar.c" /* yacc.c:1646  */
#line 1355 "grammar.y" /* yacc.c:1646  */
#line 3005 "grammar.c" /* yacc.c:1646  */
#line 1391 "grammar.y" /* yacc.c:1646  */
#line 3018 "grammar.c" /* yacc.c:1646  */
#line 1400 "grammar.y" /* yacc.c:1646  */
#line 3031 "grammar.c" /* yacc.c:1646  */
#line 1409 "grammar.y" /* yacc.c:1646  */
#line 3044 "grammar.c" /* yacc.c:1646  */
#line 1418 "grammar.y" /* yacc.c:1646  */
#line 3057 "grammar.c" /* yacc.c:1646  */
#line 1427 "grammar.y" /* yacc.c:1646  */
#line 3070 "grammar.c" /* yacc.c:1646  */
#line 1436 "grammar.y" /* yacc.c:1646  */
#line 3083 "grammar.c" /* yacc.c:1646  */
#line 1445 "grammar.y" /* yacc.c:1646  */
#line 3091 "grammar.c" /* yacc.c:1646  */
#line 1449 "grammar.y" /* yacc.c:1646  */
#line 3099 "grammar.c" /* yacc.c:1646  */
#line 1456 "grammar.y" /* yacc.c:1646  */
#line 3105 "grammar.c" /* yacc.c:1646  */
#line 1457 "grammar.y" /* yacc.c:1646  */
#line 3111 "grammar.c" /* yacc.c:1646  */
#line 1463 "grammar.y" /* yacc.c:1646  */
#line 3133 "grammar.c" /* yacc.c:1646  */
#line 1485 "grammar.y" /* yacc.c:1646  */
#line 3149 "grammar.c" /* yacc.c:1646  */
#line 1497 "grammar.y" /* yacc.c:1646  */
#line 3164 "grammar.c" /* yacc.c:1646  */
#line 1512 "grammar.y" /* yacc.c:1646  */
#line 3173 "grammar.c" /* yacc.c:1646  */
#line 1518 "grammar.y" /* yacc.c:1646  */
#line 3184 "grammar.c" /* yacc.c:1646  */
#line 1535 "grammar.y" /* yacc.c:1646  */
#line 3195 "grammar.c" /* yacc.c:1646  */
#line 1542 "grammar.y" /* yacc.c:1646  */
#line 3206 "grammar.c" /* yacc.c:1646  */
#line 1554 "grammar.y" /* yacc.c:1646  */
#line 3214 "grammar.c" /* yacc.c:1646  */
#line 1558 "grammar.y" /* yacc.c:1646  */
#line 3222 "grammar.c" /* yacc.c:1646  */
#line 1566 "grammar.y" /* yacc.c:1646  */
#line 3230 "grammar.c" /* yacc.c:1646  */
#line 1570 "grammar.y" /* yacc.c:1646  */
#line 3244 "grammar.c" /* yacc.c:1646  */
#line 1580 "grammar.y" /* yacc.c:1646  */
#line 3262 "grammar.c" /* yacc.c:1646  */
#line 1594 "grammar.y" /* yacc.c:1646  */
#line 3282 "grammar.c" /* yacc.c:1646  */
#line 1610 "grammar.y" /* yacc.c:1646  */
#line 3296 "grammar.c" /* yacc.c:1646  */
#line 1620 "grammar.y" /* yacc.c:1646  */
#line 3309 "grammar.c" /* yacc.c:1646  */
#line 1629 "grammar.y" /* yacc.c:1646  */
#line 3338 "grammar.c" /* yacc.c:1646  */
#line 1654 "grammar.y" /* yacc.c:1646  */
#line 3354 "grammar.c" /* yacc.c:1646  */
#line 1666 "grammar.y" /* yacc.c:1646  */
#line 3370 "grammar.c" /* yacc.c:1646  */
#line 1678 "grammar.y" /* yacc.c:1646  */
#line 3390 "grammar.c" /* yacc.c:1646  */
#line 1694 "grammar.y" /* yacc.c:1646  */
#line 3406 "grammar.c" /* yacc.c:1646  */
#line 1706 "grammar.y" /* yacc.c:1646  */
#line 3426 "grammar.c" /* yacc.c:1646  */
#line 1722 "grammar.y" /* yacc.c:1646  */
#line 3475 "grammar.c" /* yacc.c:1646  */
#line 1767 "grammar.y" /* yacc.c:1646  */
#line 3498 "grammar.c" /* yacc.c:1646  */
#line 1786 "grammar.y" /* yacc.c:1646  */
#line 3520 "grammar.c" /* yacc.c:1646  */
#line 1804 "grammar.y" /* yacc.c:1646  */
#line 3542 "grammar.c" /* yacc.c:1646  */
#line 1822 "grammar.y" /* yacc.c:1646  */
#line 3564 "grammar.c" /* yacc.c:1646  */
#line 1840 "grammar.y" /* yacc.c:1646  */
#line 3594 "grammar.c" /* yacc.c:1646  */
#line 1866 "grammar.y" /* yacc.c:1646  */
#line 3616 "grammar.c" /* yacc.c:1646  */
#line 1884 "grammar.y" /* yacc.c:1646  */
#line 3630 "grammar.c" /* yacc.c:1646  */
#line 1894 "grammar.y" /* yacc.c:1646  */
#line 3644 "grammar.c" /* yacc.c:1646  */
#line 1904 "grammar.y" /* yacc.c:1646  */
#line 3658 "grammar.c" /* yacc.c:1646  */
#line 1914 "grammar.y" /* yacc.c:1646  */
#line 3672 "grammar.c" /* yacc.c:1646  */
#line 1924 "grammar.y" /* yacc.c:1646  */
#line 3686 "grammar.c" /* yacc.c:1646  */
#line 1934 "grammar.y" /* yacc.c:1646  */
#line 3700 "grammar.c" /* yacc.c:1646  */
#line 1944 "grammar.y" /* yacc.c:1646  */
#line 3708 "grammar.c" /* yacc.c:1646  */
#line 3712 "grammar.c" /* yacc.c:1646  */
#line 1949 "grammar.y" /* yacc.c:1906  */
          default:
            assert(FALSE);
            default:
              assert(FALSE);

        YYERROR;