ITADN

Null dereference in print_odf_element function

#46Opendanielpyon 创建于 2023-08-22
D
danielpyoncommented
## Problem Description Note: I am aware that this project is unmaintained. However, I am still opening this issue to follow [CVE's guidelines for EOL software](https://www.cve.org/Resources/General/End-of-Life-EOL-Assignment-Process.pdf). There is a null dereference in the `print_odf_element` function when the parser handles a specially crafted Markdown file. This could be used to perform a denial-of-service attack. Here is a minimized proof-of-concept Markdown file that triggers the bug: [min_null_deref_print_odf_element.md](https://github.com/jgm/peg-markdown/files/12413267/min_null_deref_print_odf_element.md). The output is as follows: ``` AddressSanitizer:DEADLYSIGNAL ================================================================= ==761952==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000005db3b7 bp 0x000000000014 sp 0x7fffffffe030 T0) ==761952==The signal is caused by a READ memory access. ==761952==Hint: address points to the zero page. #0 0x5db3b7 in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1072:42 #1 0x5dac3a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9 #2 0x5dac3a in print_odf_element /home/sanic/peg-markdown/markdown_output.c:1054:9 #3 0x5d4c0a in print_odf_element_list /home/sanic/peg-markdown/markdown_output.c:892:9 #4 0x5d4c0a in print_element_list /home/sanic/peg-markdown/markdown_output.c:1146:26 #5 0x5dca53 in markdown_to_g_string /home/sanic/peg-markdown/markdown_lib.c:163:5 #6 0x5dce84 in markdown_to_string /home/sanic/peg-markdown/markdown_lib.c:175:11 #7 0x4c4d06 in main /home/sanic/peg-markdown/markdown.c:180:11 #8 0x7ffff7b25082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #9 0x41c50d in _start (/home/sanic/peg-markdown/markdown+0x41c50d) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /home/sanic/peg-markdown/markdown_output.c:1072:42 in print_odf_element ==761952==ABORTING ``` ## Reproduction Steps 1. Compile the project using ASAN (Address Sanitizer). For example, `CC=afl-clang-fast AFL_USE_ASAN=1 make`. 2. Run `./markdown --to=odf min_null_deref_print_odf_element.md` (use the proof-of-concept file attached to this report). 3. Observe the null dereference in the output.
0 条评论