Created attachment 411611 [details] ./nasm -f bin POC13 -o tmp Description: The debugging information is as follows: $ ./nasm -f bin POC13 -o tmp id:000571,sig:11,src:007713,op:havoc,rep:16:2: error: parser: instruction expected id:000571,sig:11,src:007713,op:havoc,rep:16:4: error: `%endrep': no matching `%rep' id:000571,sig:11,src:007713,op:havoc,rep:16:5: warning: label alone on a line without a colon might be in error [-w+orphan-labels] id:000571,sig:11,src:007713,op:havoc,rep:16:13: warning: label alone on a line without a colon might be in error [-w+orphan-labels] id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: label or instruction expected at start of line id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%ifnmacro' expects a parameter count or nothing id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%%nduacro': not in a macro call id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%rep' expects a repeat count id:000571,sig:11,src:007713,op:havoc,rep:16:18: error: parser: instruction expected Segmentation fault The GDB debugging information is as follows: (gdb)set args -f bin POC13 -o tmp (gdb) r Starting program: /home/company/check_nasm/nasm-2.14rc0/install/bin/nasm -f bin id:000571,sig:11,src:007713,op:havoc,rep:16 -o tmp id:000571,sig:11,src:007713,op:havoc,rep:16:2: error: parser: instruction expected id:000571,sig:11,src:007713,op:havoc,rep:16:4: error: `%endrep': no matching `%rep' id:000571,sig:11,src:007713,op:havoc,rep:16:5: warning: label alone on a line without a colon might be in error [-w+orphan-labels] id:000571,sig:11,src:007713,op:havoc,rep:16:13: warning: label alone on a line without a colon might be in error [-w+orphan-labels] id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: label or instruction expected at start of line id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%ifnmacro' expects a parameter count or nothing id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%%nduacro': not in a macro call id:000571,sig:11,src:007713,op:havoc,rep:16:13: error: `%rep' expects a repeat count id:000571,sig:11,src:007713,op:havoc,rep:16:18: error: parser: instruction expected Program received signal SIGSEGV, Segmentation fault. 0x0000000000425e54 in pp_list_one_macro (m=0x21, severity=1282) at asm/preproc.c:5389 5389 pp_list_one_macro(m->next_active, severity); (gdb) bt #0 0x0000000000425e54 in pp_list_one_macro (m=0x21, severity=1282) at asm/preproc.c:5389 #1 0x0000000000425e60 in pp_list_one_macro (m=0x7c73b0, severity=1282) at asm/preproc.c:5389 #2 0x0000000000425dce in pp_error_list_macros (severity=<optimized out>) at asm/preproc.c:5406 #3 0x00000000004066ec in nasm_verror_common (severity=2, fmt=<optimized out>, args=<optimized out>) at asm/nasm.c:1665 #4 0x0000000000405158 in nasm_verror_gnu (severity=2, fmt=0x4a8763 "parser: instruction expected", ap=0x7fffffffdfa0) at asm/nasm.c:1508 #5 0x000000000040d8c3 in nasm_error (severity=<error reading variable: Value out of range.>, fmt=0x502 <error: Cannot access memory at address 0x502>) at asm/error.c:86 #6 0x0000000000420266 in parse_line (pass=<optimized out>, buffer=<optimized out>, result=<optimized out>, ldef=<optimized out>) at asm/parser.c:1087 #7 0x00000000004036fb in assemble_file (fname=<optimized out>, depend_ptr=<optimized out>) at asm/nasm.c:1245 #8 main (argc=<optimized out>, argv=<optimized out>) at asm/nasm.c:453 (gdb) ASAN info: ================================================================= ==70872==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f00000d538 at pc 0x522078 bp 0x7fffffffdee0 sp 0x7fffffffded8 READ of size 8 at 0x60f00000d538 thread T0 ==70872==WARNING: Trying to symbolize code, but external symbolizer is not initialized! #0 0x522077 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x522077) #1 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516) #2 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) #3 0x47e7e8 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x47e7e8) 0x60f00000d538 is located 40 bytes inside of 176-byte region [0x60f00000d510,0x60f00000d5c0) freed by thread T0 here: #0 0x468579 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x468579) #1 0x49c2bd (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x49c2bd) #2 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516) #3 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) previously allocated by thread T0 here: #0 0x4686f9 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x4686f9) #1 0x49b6a8 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x49b6a8) #2 0x51be1a (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x51be1a) #3 0x483516 (/home/company/check_nasm/nasm-2.14rc0/install_asan/bin/nasm+0x483516) #4 0x7ffff6ee6a3f (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) SUMMARY: AddressSanitizer: heap-use-after-free ??:0 ?? Shadow bytes around the buggy address: 0x0c1e7fff9a50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1e7fff9a60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1e7fff9a70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1e7fff9a80: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd 0x0c1e7fff9a90: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa =>0x0c1e7fff9aa0: fa fa fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd 0x0c1e7fff9ab0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c1e7fff9ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1e7fff9ad0: 00 00 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 0x0c1e7fff9ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c1e7fff9af0: 00 00 00 00 fa fa fa fa fa fa fa fa 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==70872==ABORTING [Inferior 1 (process 70872) exited with code 01] The bug was trigged in: pp_list_one_macro (m=0x21, severity=1282) at asm/preproc.c:5389 5389 pp_list_one_macro(m->next_active, severity); Credits: This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability
*** Bug 3392434 has been marked as a duplicate of this bug. ***
No longer triggers with upcoming 2.13.02 (will be released soon).