ITADN

Stack overflow in process_raw_blocks

#47Opendanielpyon 创建于 2023-08-22
D
danielpyoncommented
## Problem Description Note: I am aware that this project is unmaintained. However, I am still opening this issue to follow [CVE's guidelines for EOL software](https://www.cve.org/Resources/General/End-of-Life-EOL-Assignment-Process.pdf). There is a stack overflow (aka: infinite recursion) in the `process_raw_blocks` function when the parser handles a specially crafted Markdown file. This could be used to perform a denial-of-service attack. Here is a minimized proof-of-concept Markdown file that triggers the bug: [min_stack_overflow.md](https://github.com/jgm/peg-markdown/files/12413332/min_stack_overflow.md). The output is as follows: ``` #210 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #211 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #212 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #213 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #214 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #215 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #216 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #217 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #218 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #219 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #220 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #221 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #222 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #223 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #224 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #225 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #226 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #227 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #228 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #229 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #230 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #231 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #232 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #233 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #234 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #235 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #236 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #237 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #238 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #239 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #240 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #241 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #242 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #243 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #244 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #245 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #246 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #247 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 #248 0x5dcd55 in process_raw_blocks /home/sanic/peg-markdown/markdown_lib.c:137:33 SUMMARY: AddressSanitizer: stack-overflow /home/sanic/peg-markdown/markdown_lib.c:113 in process_raw_blocks ==2808508==ABORTING ``` ## Reproduction Steps 1. Compile the project using ASAN (Address Sanitizer). For example, `CC=afl-clang-fast AFL_USE_ASAN=1 make`. 2. Run `./markdown -x min_stack_overflow.md` (use the proof-of-concept file attached to this report). 3. Observe the stack overflow in the output.
0 条评论