Created attachment 411605 [details]
./nasm -f bin  POC7 -o tmp

Description:

The debugging information is as follows:

$ ./nasm -f bin  POC7 -o tmp 
...
id:000411,sig:06,src:005439,op:havoc,rep:2:34: warning: (b_struc:9) trailing garbage after expression ignored
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: (b_struc:11) unknown preprocessor directive `%top_'
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: label or instruction expected at start of line
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: warning: (b_struc:11) trailing garbage after expression ignored
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: end of file while still in %rep
*** Error in `./../../../nasm': double free or corruption (fasttop): 0x00000000008f8f70 ***
Aborted

The GDB debugging information is as follows:

(gdb)set args -f bin  POC7 -o tmp
(gdb) r 
...
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: label or instruction expected at start of line
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: warning: (b_struc:11) trailing garbage after expression ignored
id:000411,sig:06,src:005439,op:havoc,rep:2:20: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: end of file while still in %rep
*** Error in `/home/company/check_nasm/nasm-2.14rc0/install/bin/nasm': double free or corruption (fasttop): 0x00000000007c6f70 ***

Program received signal SIGABRT, Aborted.
0x00007ffff7a44267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
55	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt 
#0  0x00007ffff7a44267 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007ffff7a45eca in __GI_abort () at abort.c:89
#2  0x00007ffff7a87c53 in __libc_message (do_abort=do_abort@entry=1, 
    fmt=fmt@entry=0x7ffff7ba01a8 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff7a8fc69 in malloc_printerr (ptr=<optimized out>, 
    str=0x7ffff7ba0270 "double free or corruption (fasttop)", action=1) at malloc.c:4965
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3834
#5  0x00007ffff7a9389c in __GI___libc_free (mem=<optimized out>) at malloc.c:2950
#6  0x00000000004089d8 in nasm_free (q=0x51aa) at nasmlib/malloc.c:77
#7  0x00000000004250c8 in delete_Token (t=<optimized out>, t=<optimized out>) at asm/preproc.c:1236
#8  free_tlist (list=<optimized out>, list=<optimized out>) at asm/preproc.c:612
#9  free_llist (list=<optimized out>, list=<optimized out>) at asm/preproc.c:622
#10 free_mmacro (m=<optimized out>, m=<optimized out>) at asm/preproc.c:635
#11 pp_cleanup (pass=1) at asm/preproc.c:5242
#12 0x0000000000404430 in assemble_file (fname=<optimized out>, depend_ptr=<optimized out>) at asm/nasm.c:1439
#13 main (argc=<optimized out>, argv=<optimized out>) at asm/nasm.c:453
(gdb) 

ASAN info:
(gdb) r 
...

Breakpoint 18, pp_verror (severity=<optimized out>, fmt=<optimized out>, arg=<optimized out>) at asm/preproc.c:4930
4930	            mmac = mmac->next_active, delta++;
(gdb) c 3 
Will ignore next 2 crossings of breakpoint 18.  Continuing.
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: (b_struc:9) braces do not enclose all of macro parameter
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: expression syntax error
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: (b_struc:9) braces do not enclose all of macro parameter
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: symbol `imev' redefined
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: error: expression syntax error
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here
id:000411,sig:06,src:005439,op:havoc,rep:2:34: warning: (b_struc:9) trailing garbage after expression ignored
id:000411,sig:06,src:005439,op:havoc,rep:2:17: ... from macro `b_struc' defined here

Breakpoint 18, pp_verror (severity=<optimized out>, fmt=<optimized out>, arg=<optimized out>) at asm/preproc.c:4930
4930	            mmac = mmac->next_active, delta++;
...
(gdb) n
4930	            mmac = mmac->next_active, delta++;
(gdb) n
=================================================================
==17735==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00000d430 at pc 0x52f048 bp 0x7fffffffb990 sp 0x7fffffffb988
READ of size 8 at 0x60f00000d430 thread T0
==17735==WARNING: Trying to symbolize code, but external symbolizer is not initialized!
    #0 0x52f047 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x52f047)
    #1 0x4b42df (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x4b42df)
    #2 0x539312 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x539312)
    #3 0x51be1a (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x51be1a)
    #4 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516)
    #5 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #6 0x47e7e8 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x47e7e8)

0x60f00000d430 is located 16 bytes inside of 176-byte region [0x60f00000d420,0x60f00000d4d0)
freed by thread T0 here:
    #0 0x468579 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x468579)
    #1 0x49c2bd (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x49c2bd)
    #2 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516)
    #3 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)

previously allocated by thread T0 here:
    #0 0x4686f9 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x4686f9)
    #1 0x49b6a8 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x49b6a8)
    #2 0x51be1a (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x51be1a)
    #3 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516)
    #4 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)

SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ??
Shadow bytes around the buggy address:
  0x0c1e7fff9a30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff9a40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1e7fff9a60: fa fa fa fa fa fa 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff9a70: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
=>0x0c1e7fff9a80: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fd
  0x0c1e7fff9a90: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x0c1e7fff9aa0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff9ab0: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
  0x0c1e7fff9ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1e7fff9ad0: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==17735==ABORTING
[Inferior 1 (process 17735) exited with code 01]
(gdb) 


The bug was trigged in:
pp_verror (severity=<optimized out>, fmt=<optimized out>, arg=<optimized out>) at asm/preproc.c:4930
4930	            mmac = mmac->next_active, delta++;



Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability.