[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 28 Nov 2014 16:57:07 +1100
From: Jonathan Gray <jsg@....id.au>
To: oss-security@...ts.openwall.com
Cc: xi@...olvent.net,
ingy@...n.org
Subject: libyaml / YAML-LibYAML DoS
libyaml and the perl YAML-LibYAML (aka YAML-XS) module based
on the same code have an "impossible" assert that can be
triggered with the following yaml. This is a reduced testcase
of a crash found with the afl fuzzer.
a: "
" b: true
In other words a crash/denial of service with untrusted yaml input.
The libyaml author was contacted on the 21st and 27th of November.
No response has been received but the issue has independently been
reported publically since:
https://bitbucket.org/xi/libyaml/issue/10/wrapped-strings-cause-assert-failure
[1] Parsing 'test.yaml': assertion "parser->simple_key_allowed || !required" failed: file "scanner.c", line 1113, function "yaml_parser_save_simple_key"
assert(parser->simple_key_allowed || !required); /* Impossible. */
Program received signal SIGABRT, Aborted.
0x000008ab4466136a in kill () at <stdin>:2
2 <stdin>: No such file or directory.
in <stdin>
Current language: auto; currently asm
(gdb) bt
#0 0x000008ab4466136a in kill () at <stdin>:2
#1 0x000008ab446c37b9 in abort () at /usr/src/lib/libc/stdlib/abort.c:53
#2 0x000008ab4463e254 in __assert2 (file=Variable "file" is not available.
)
at /usr/src/lib/libc/gen/assert.c:52
#3 0x000008aa98789dba in yaml_parser_save_simple_key (parser=0x7f7ffffbe940)
at scanner.c:1113
#4 0x000008aa9878d6e7 in yaml_parser_fetch_plain_scalar (
parser=0x7f7ffffbe940) at scanner.c:1903
#5 0x000008aa98789c14 in yaml_parser_fetch_next_token (parser=0x7f7ffffbe940)
at scanner.c:1039
#6 0x000008aa98788ce6 in yaml_parser_fetch_more_tokens (parser=0x7f7ffffbe940)
at scanner.c:846
#7 0x000008aa9879ef0b in yaml_parser_parse_block_mapping_key (
parser=0x7f7ffffbe940, event=0x7f7ffffbeb20, first=0) at parser.c:847
#8 0x000008aa9879c641 in yaml_parser_state_machine (parser=0x7f7ffffbe940,
event=0x7f7ffffbeb20) at parser.c:267
#9 0x000008aa9879c394 in yaml_parser_parse (parser=0x7f7ffffbe940,
event=0x7f7ffffbeb20) at parser.c:188
#10 0x000008a880401294 in main (argc=2, argv=0x7f7ffffbec08) at run-parser.c:42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
