Bug 1470714 - There is a heap based buffer overflow in libsass .
There is a heap based buffer overflow in libsass .
Status: ASSIGNED
Product: Fedora
Classification: Fedora
Component: sassc (Show other bugs)
27
x86_64 Linux
unspecified Severity urgent
: ---
: ---
Assigned To: Aurelien Bompard
Fedora Extras Quality Assurance
: Security
Depends On:
Blocks: CVE-2017-11341
  Show dependency treegraph
 
Reported: 2017-07-13 09:58 EDT by owl337
Modified: 2017-08-15 05:11 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Triggered by "./sassc $POC" (71 bytes, application/x-rar)
2017-07-13 09:58 EDT, owl337
no flags Details

  None (edit)
Description owl337 2017-07-13 09:58:15 EDT
Created attachment 1297634 [details]
Triggered by  "./sassc $POC"

Description of problem:

The details is at "Steps to Reproduce".

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

 ./sassc POC1

Steps to Reproduce:

The debugging information is as follows:

$ ./sassc POC1

icy@ubuntu:~/secreal/sassc-asan/install/bin$ ./sassc POC1
=================================================================
==67263==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000eff5 at pc 0x7fd73fe26402 bp 0x7ffd3422b080 sp 0x7ffd3422b078
READ of size 1 at 0x60200000eff5 thread T0
    #0 0x7fd73fe26401  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x4f1401)
    #1 0x7fd73fe42616  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x50d616)
    #2 0x7fd73fe42518  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x50d518)
    #3 0x7fd73fe41d1f  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x50cd1f)
    #4 0x7fd73fe40bdf  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x50bbdf)
    #5 0x7fd73fe405d3  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x50b5d3)
    #6 0x7fd73fe39361  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x504361)
    #7 0x7fd73fd42fe2  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x40dfe2)
    #8 0x7fd73fd2166a  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x3ec66a)
    #9 0x7fd73fd18597  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x3e3597)
    #10 0x7fd73fd14cd5  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x3dfcd5)
    #11 0x7fd73fba7ce5  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x272ce5)
    #12 0x7fd73fbbde82  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x288e82)
    #13 0x7fd7400cfe60  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x79ae60)
    #14 0x7fd7400ceaa1  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x799aa1)
    #15 0x7fd7400ceee1  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x799ee1)
    #16 0x4ddfc5  (/home/icy/secreal/sassc-asan/install/bin/sassc+0x4ddfc5)
    #17 0x4debe5  (/home/icy/secreal/sassc-asan/install/bin/sassc+0x4debe5)
    #18 0x7fd73e6c0a3f  (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
    #19 0x436508  (/home/icy/secreal/sassc-asan/install/bin/sassc+0x436508)

0x60200000eff5 is located 0 bytes to the right of 5-byte region [0x60200000eff0,0x60200000eff5)
allocated by thread T0 here:
    #0 0x4bd4d2  (/home/icy/secreal/sassc-asan/install/bin/sassc+0x4bd4d2)
    #1 0x7fd73fcd209c  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x39d09c)
    #2 0x7fd73fbbcd47  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x287d47)
    #3 0x7fd7400cfe60  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x79ae60)
    #4 0x7fd7400ceaa1  (/home/icy/secreal/libsass-asan/install/lib/libsass.so.1+0x799aa1)

Shadow bytes around the buggy address:
  0x0c047fff9da0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9db0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9dd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9de0: fa fa fd fd fa fa 04 fa fa fa 00 fa fa fa 00 00
=>0x0c047fff9df0: fa fa 00 00 fa fa 00 fa fa fa fd fa fa fa[05]fa
  0x0c047fff9e00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c047fff9e40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==67263==ABORTING

The vulnerability was triggered in function exactly() at src/lexer.hpp:92 .

 88     // Match a single character literal.
 89     // Regex equivalent: /(?:x)/
 90     template <char chr>
 91     const char* exactly(const char* src) {
 92       return *src == chr ? src + 1 : 0;
 93     }

The GDB debugging information is as follows:
(gdb) set args POC1
(gdb) r
...
(gdb) bt
#0  Sass::Prelexer::exactly<(char)92> (src=<optimized out>) at ./lexer.hpp:92
#1  Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)92>, &Sass::Prelexer::re_linebreak> (
    src=<optimized out>) at ./lexer.hpp:218
#2  Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)92>, &Sass::Prelexer::re_linebreak>, &Sass::Prelexer::escape_seq, &Sass::Prelexer::unicode_seq, &Sass::Prelexer::interpolant, &Sass::Prelexer::any_char_but<(char)39> > (src=<optimized out>) at ./lexer.hpp:202
#3  Sass::Prelexer::zero_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)92>, &Sass::Prelexer::re_linebreak>, &Sass::Prelexer::escape_seq, &Sass::Prelexer::unicode_seq, &Sass::Prelexer::interpolant, &Sass::Prelexer::any_char_but<(char)39> > > (src=<optimized out>) at ./lexer.hpp:236
#4  Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)92>, &Sass::Prelexer::re_linebreak>, &Sass::Prelexer::escape_seq, &Sass::Prelexer::unicode_seq, &Sass::Prelexer::interpolant, &Sass::Prelexer::any_char_but<(char)39> > >, &Sass::Prelexer::exactly<(char)39> > (src=<optimized out>) at ./lexer.hpp:218
#5  Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)39>, &Sass::Prelexer::zero_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)92>, &Sass::Prelexer::re_linebreak>, &Sass::Prelexer::escape_seq, &Sass::Prelexer::unicode_seq, &Sass::Prelexer::interpolant, &Sass::Prelexer::any_char_but<(char)39> > >, &Sass::Prelexer::exactly<(char)39> > (src=0x60200000eff1 "'~\\") at ./lexer.hpp:219
#6  Sass::Prelexer::single_quoted_string (src=0x60200000eff1 "'~\\") at prelexer.cpp:513
#7  Sass::Prelexer::alternatives<&Sass::Prelexer::single_quoted_string, &Sass::Prelexer::double_quoted_string>
    (src=0x60200000eff1 "'~\\") at ./lexer.hpp:202
---Type <return> to continue, or q <return> to quit---
#8  Sass::Prelexer::quoted_string (src=0x60200000eff1 "'~\\") at prelexer.cpp:561
#9  0x00007ffff77f5617 in Sass::Prelexer::alternatives<&Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> (src=0x60200000eff1 "'~\\") at ./lexer.hpp:202
#10 0x00007ffff77f5519 in Sass::Prelexer::alternatives<&Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> (
    src=<optimized out>) at ./lexer.hpp:203
#11 Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> (
    src=<optimized out>) at ./lexer.hpp:203
#12 Sass::Prelexer::sequence<&Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > (src=<optimized out>) at ./lexer.hpp:212
#13 Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimen---Type <return> to continue, or q <return> to quit---
sion, &Sass::Prelexer::alnum> > (src=<optimized out>) at ./lexer.hpp:219
#14 0x00007ffff77f4d20 in Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > > (src=<optimized out>)
    at ./lexer.hpp:244
#15 Sass::Prelexer::sequence<&Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > (src=<optimized out>) at ./lexer.hpp:218
#16 Sass::Prelexer::sequence<&Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentag---Type <return> to continue, or q <return> to quit---
e, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > (src=<optimized out>) at ./lexer.hpp:219
#17 Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > (
    src=<optimized out>) at ./lexer.hpp:219
#18 Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::---Type <return> to continue, or q <return> to quit---
binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:196
#19 Sass::Prelexer::alternatives<&Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#20 Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelex---Type <return> to continue, or q <return> to quit---
er::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#21 0x00007ffff77f3be0 in Sass::Prelexer::alternatives<&Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Pre---Type <return> to continue, or q <return> to quit---
lexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#22 Sass::Prelexer::alternatives<&Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#23 Sass::Prelexer::alternatives<&Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &S---Type <return> to continue, or q <return> to quit---
ass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (
    src=0x60200000eff1 "'~\\") at ./lexer.hpp:203
#24 0x00007ffff77f35d4 in Sass::Prelexer::alternatives<&Sass::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::---Type <return> to continue, or q <return> to quit---
suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#25 Sass::Prelexer::alternatives<&Sass::Prelexer::block_comment, &Sass::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate---Type <return> to continue, or q <return> to quit---
<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=<optimized out>) at ./lexer.hpp:203
#26 Sass::Prelexer::alternatives<&Sass::Prelexer::spaces, &Sass::Prelexer::block_comment, &Sass::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::varia---Type <return> to continue, or q <return> to quit---
ble, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > (src=0x60200000eff1 "'~\\")
    at ./lexer.hpp:203
#27 0x00007ffff77ec362 in Sass::Prelexer::one_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::spaces, &Sass::Prelexer::block_comment, &Sass::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > > (src=<optimized out>) at ./lexer.hpp:246
---Type <return> to continue, or q <return> to quit---
#28 Sass::Prelexer::alternatives<&Sass::Prelexer::one_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::spaces, &Sass::Prelexer::block_comment, &Sass::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > > > (src=<optimized out>) at ./lexer.hpp:196
#29 Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::ampersand, &Sass::Prelexer::one_plus<&Sass::Prelexer::exactly<(char)45> >, &Sass::Prelexer::word_boundary, &Sass::Prelexer::optional_spaces>, &Sass::Prelexer::one_plus<&Sass::Prelexer::alternatives<&Sass::Prelexer::spaces, &Sass::Prelexer::block_comment, &Sass---Type <return> to continue, or q <return> to quit---
::Prelexer::line_comment, &Sass::Prelexer::schema_reference_combinator, &Sass::Prelexer::class_char<&Sass::Constants::selector_lookahead_ops>, &Sass::Prelexer::class_char<&Sass::Constants::selector_combinator_ops>, &Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)40>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::optional<&Sass::Prelexer::re_selector_list>, &Sass::Prelexer::optional_spaces, &Sass::Prelexer::exactly<(char)41> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::exact_match, &Sass::Prelexer::class_match, &Sass::Prelexer::dash_match, &Sass::Prelexer::prefix_match, &Sass::Prelexer::suffix_match, &Sass::Prelexer::substring_match>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::namespace_schema>, &Sass::Prelexer::alternatives<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)35>, &Sass::Prelexer::negate<&Sass::Prelexer::exactly<(char)123> > >, &Sass::Prelexer::exactly<(char)46>, &Sass::Prelexer::sequence<&Sass::Prelexer::optional<&Sass::Prelexer::pseudo_prefix>, &Sass::Prelexer::negate<&Sass::Prelexer::uri_prefix> > >, &Sass::Prelexer::one_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::zero_plus<&Sass::Prelexer::sequence<&Sass::Prelexer::exactly<(char)45>, &Sass::Prelexer::optional_spaces> >, &Sass::Prelexer::alternatives<&Sass::Prelexer::kwd_optional, &Sass::Prelexer::exactly<(char)42>, &Sass::Prelexer::quoted_string, &Sass::Prelexer::interpolant, &Sass::Prelexer::identifier, &Sass::Prelexer::variable, &Sass::Prelexer::percentage, &Sass::Prelexer::binomial, &Sass::Prelexer::dimension, &Sass::Prelexer::alnum> > >, &Sass::Prelexer::zero_plus<&Sass::Prelexer::exactly<(char)45> > > > > > (
    src=<optimized out>) at ./lexer.hpp:203
#30 Sass::Prelexer::re_selector_list (src=<optimized out>) at prelexer.cpp:1582
#31 0x00007ffff76f5fe3 in Sass::Parser::peek<&Sass::Prelexer::re_selector_list> (start=<optimized out>, 
    this=<optimized out>) at ./parser.hpp:121
#32 Sass::Parser::lookahead_for_selector (this=0x7fffffffd930, start=<optimized out>) at parser.cpp:2634
---Type <return> to continue, or q <return> to quit---
#33 0x00007ffff76d466b in Sass::Parser::parse_block_node (this=<optimized out>, is_root=true) at parser.cpp:264
#34 0x00007ffff76cb598 in Sass::Parser::parse_block_nodes (this=0x7fffffffd930, is_root=<optimized out>)
    at parser.cpp:187
#35 0x00007ffff76c7cd6 in Sass::Parser::parse (this=0x7fffffffd930) at parser.cpp:113
#36 0x00007ffff755ace6 in Sass::Context::register_resource (this=0x619000001980, inc=..., res=..., 
    prstate=<optimized out>) at context.cpp:323
#37 0x00007ffff7570e83 in Sass::File_Context::parse (this=<optimized out>) at context.cpp:585
#38 0x00007ffff7a82e61 in Sass::sass_parse_block (compiler=0x6040000095d0) at sass_context.cpp:227
#39 sass_compiler_parse (compiler=<optimized out>) at sass_context.cpp:476
#40 0x00007ffff7a81aa2 in sass_compile_context (c_ctx=0x611000009f00, cpp_ctx=0x7ffff7fd8778)
    at sass_context.cpp:364
#41 0x00007ffff7a81ee2 in sass_compile_file_context (file_ctx=0x611000009f00) at sass_context.cpp:463
#42 0x00000000004ddfc6 in compile_file (options=0x60c00000bf80, input_path=<optimized out>, outfile=0x0)
    at sassc.c:145
#43 0x00000000004debe6 in main (argc=<optimized out>, argv=<optimized out>) at sassc.c:335



Actual results:

crash

Expected results:

crash

Additional info:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability.
Comment 1 Adam Mariš 2017-07-24 08:42:19 EDT
Please, report this issue to upstream. Thanks!
Comment 2 Aurelien Bompard 2017-08-04 11:33:45 EDT
I updated sassc to 3.4.5, and I get this:

$ sassc POC1 
Error: Invalid CSS after "[": expected 1 selector or at-rule, was "['~\\"
        on line 1 of POC1
>> ['~\
   ^

Can you check whether the updated version still contains the bug? Thanks.
Comment 3 Jan Kurik 2017-08-15 05:11:13 EDT
This bug appears to have been reported against 'rawhide' during the Fedora 27 development cycle.
Changing version to '27'.

Note You need to log in before you can comment on or make changes to this bug.