libyaml icon indicating copy to clipboard operation
libyaml copied to clipboard

Find heap buffer overflow by running fuzz test

Open ziyangc97 opened this issue 3 years ago • 0 comments

hi, I am using the oss-fuzz google/oss-fuzz against libyaml and when I run libyaml_dumper_fuzzer I find a heap buffer overflow error in function: yaml_emitter_emit_flow_sequence_item. the erro log is in this pic: image

I also attach the full error log here: fuzz_error_log.TXT

Due to my limited knowledge of fuzz test I don't know how to find the exact input yaml or string to reproduce this error, but I think the error log can help us to analysis and fix the error.

Code analysis: It is obvious that in emitter.c line 761, we try to pop the element from STACK and get emitter->indents value. However, we didn't check whether STACK is empty and in this case, we try to dereference a pointer: (*(--(stack).top)) and stack.top maybe NULL and cause heap buffer overflow.

Fix: I think it's necessary to add STACK_EMPTY before POP, the goal is to check whether stack.top has values and avoid dereferencing a NULL pointer.

I will create a PR to fix this problem. https://github.com/yaml/libyaml/pull/259

ziyangc97 avatar Nov 25 '22 03:11 ziyangc97