Vulnerability: Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, allows attackers to cause a denial of service.
Vulnerability ID: CVE-2020-21572
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/trgil/gilcc
Published: 2021-11-02
File: src/src_parser.c
Commit message: Fix parser tmp-buffer overflow issue
Commit author: gil

Vulnerable version (before fix):
 static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const                             (PBUF_TMP_PREV_CHAR(pbuf) == ' ' || PBUF_TMP_PREV_CHAR(pbuf) == '\t' ||                              PBUF_TMP_PREV_CHAR(pbuf) == '\n')) {                         pbuf.f_indx++;                     } else if (pbuf.tmp_indx &&                              (PBUF_TMP_PREV_CHAR(pbuf) == '\\')) {                         pbuf.tmp_indx--;                         pbuf.f_indx++; static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const                     continue;                  case '\\':                     p_buf_push_tmp_char(&pbuf, '\\');                     continue;                  case '/':                     p_buf_push_tmp_char(&pbuf, '/');                     continue; 

Fixed version (after fix):
 static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const                             (PBUF_TMP_PREV_CHAR(pbuf) == ' ' || PBUF_TMP_PREV_CHAR(pbuf) == '\t' ||                              PBUF_TMP_PREV_CHAR(pbuf) == '\n')) {                         pbuf.f_indx++;                     } else if (pbuf.tmp_indx &&                             (PBUF_TMP_PREV_CHAR(pbuf) == '\\')) {                         pbuf.tmp_indx--;                         pbuf.f_indx++; static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const                     continue;                  case '\\':                     p_buf_write_tmp(&pbuf, tmp_fd);                     p_buf_push_tmp_char(&pbuf, '\\');                     continue;                  case '/':                     p_buf_write_tmp(&pbuf, tmp_fd);                     p_buf_push_tmp_char(&pbuf, '/');                     continue; 

Patch:
patch: @@ -171,7 +171,7 @@ static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const
                             (PBUF_TMP_PREV_CHAR(pbuf) == ' ' || PBUF_TMP_PREV_CHAR(pbuf) == '\t' ||
                              PBUF_TMP_PREV_CHAR(pbuf) == '\n')) {
                         pbuf.f_indx++;
-                    } else if (pbuf.tmp_indx && 
+                    } else if (pbuf.tmp_indx &&
                             (PBUF_TMP_PREV_CHAR(pbuf) == '\\')) {
                         pbuf.tmp_indx--;
                         pbuf.f_indx++;
@@ -182,10 +182,12 @@ static int src_parser_trans_stage_1_2_3(const int tmp_fd, const char *src, const
                     continue;
 
                 case '\\':
+                    p_buf_write_tmp(&pbuf, tmp_fd);
                     p_buf_push_tmp_char(&pbuf, '\\');
                     continue;
 
                 case '/':
+                    p_buf_write_tmp(&pbuf, tmp_fd);
                     p_buf_push_tmp_char(&pbuf, '/');
                     continue;
path: src/src_parser.c