AddressSanitizer: heap-buffer-overflow (OOB read) in Sass::Selector_List::operator== (ast.cpp:469)

[hongxuchen]

We found with our fuzzer a heap buffer overflow in calling std::sort in Sass::Selector_List::operator== at Line 469 of ast.cpp (45f5087) when compiled with Address Sanitizer (using sassc as the driver).

=================================================================
==19419==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61400000ee08 at pc 0x7ff7e4647120 bp 0x7ffc7717a780 sp 0x7ffc7717a770
READ of size 8 at 0x61400000ee08 thread T0
    #0 0x7ff7e464711f in void std::__introsort_loop<__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes> >(__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes>) /usr/include/c++/5/bits/stl_algo.h:1935
    #1 0x7ff7e4646e4c in void std::__introsort_loop<__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes> >(__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes>) /usr/include/c++/5/bits/stl_algo.h:1949
    #2 0x7ff7e461355b in void std::__sort<__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes> >(__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes>) /usr/include/c++/5/bits/stl_algo.h:1963
    #3 0x7ff7e461355b in void std::sort<__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, Sass::OrderNodes>(__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, Sass::OrderNodes) /usr/include/c++/5/bits/stl_algo.h:4729
    #4 0x7ff7e461355b in Sass::Selector_List::operator==(Sass::Selector_List const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:469
    #5 0x7ff7e45f46fa in Sass::Wrapped_Selector::operator==(Sass::Wrapped_Selector const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:797
    #6 0x7ff7e45f809c in Sass::Simple_Selector::operator!=(Sass::Simple_Selector const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.hpp:2364
    #7 0x7ff7e45f809c in Sass::Compound_Selector::operator<(Sass::Compound_Selector const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:162
    #8 0x7ff7e48e98b5 in bool Sass::OrderNodes::operator()<Sass::SharedImpl<Sass::Compound_Selector> >(Sass::SharedImpl<Sass::Compound_Selector> const&, Sass::SharedImpl<Sass::Compound_Selector> const&) const /home/hongxu/FUZZ/libsass-orig/src/ast_fwd_decl.hpp:375
    #9 0x7ff7e48e98b5 in std::_Rb_tree<Sass::SharedImpl<Sass::Compound_Selector>, Sass::SharedImpl<Sass::Compound_Selector>, std::_Identity<Sass::SharedImpl<Sass::Compound_Selector> >, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >::_M_lower_bound(std::_Rb_tree_node<Sass::SharedImpl<Sass::Compound_Selector> >*, std::_Rb_tree_node<Sass::SharedImpl<Sass::Compound_Selector> >*, Sass::SharedImpl<Sass::Compound_Selector> const&) /usr/include/c++/5/bits/stl_tree.h:1628
    #10 0x7ff7e48e98b5 in std::_Rb_tree<Sass::SharedImpl<Sass::Compound_Selector>, Sass::SharedImpl<Sass::Compound_Selector>, std::_Identity<Sass::SharedImpl<Sass::Compound_Selector> >, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >::find(Sass::SharedImpl<Sass::Compound_Selector> const&) /usr/include/c++/5/bits/stl_tree.h:2295
    #11 0x7ff7e48e3b4d in std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >::find(Sass::SharedImpl<Sass::Compound_Selector> const&) /usr/include/c++/5/bits/stl_set.h:695
    #12 0x7ff7e48e3b4d in Sass::Extend::extendSelectorList(Sass::SharedImpl<Sass::Selector_List>, bool, bool&, std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >&) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:1934
    #13 0x7ff7e48e57d1 in Sass::Extend::extendSelectorList(Sass::SharedImpl<Sass::Selector_List>, std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >&) /home/hongxu/FUZZ/libsass-orig/src/extend.hpp:67
    #14 0x7ff7e48e57d1 in Sass::Extend::extendSelectorList(Sass::SharedImpl<Sass::Selector_List>, bool, bool&, std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >&) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:1979
    #15 0x7ff7e48e57d1 in Sass::Extend::extendSelectorList(Sass::SharedImpl<Sass::Selector_List>, std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >&) /home/hongxu/FUZZ/libsass-orig/src/extend.hpp:67
    #16 0x7ff7e48e57d1 in Sass::Extend::extendSelectorList(Sass::SharedImpl<Sass::Selector_List>, bool, bool&, std::set<Sass::SharedImpl<Sass::Compound_Selector>, Sass::OrderNodes, std::allocator<Sass::SharedImpl<Sass::Compound_Selector> > >&) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:1979
    #17 0x7ff7e48e77af in Sass::Extend::extendObjectWithSelectorAndBlock(Sass::Ruleset*) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:2058
    #18 0x7ff7e48e7a32 in Sass::Extend::operator()(Sass::Ruleset*) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:2109
    #19 0x7ff7e48c33c7 in Sass::Extend::operator()(Sass::Block*) /home/hongxu/FUZZ/libsass-orig/src/extend.cpp:2082
    #20 0x7ff7e466577b in Sass::Context::compile() /home/hongxu/FUZZ/libsass-orig/src/context.cpp:727
    #21 0x7ff7e46687b1 in Sass::File_Context::parse() /home/hongxu/FUZZ/libsass-orig/src/context.cpp:643
    #22 0x7ff7e4944af9 in sass_parse_block /home/hongxu/FUZZ/libsass-orig/src/sass_context.cpp:234
    #23 0x7ff7e4944af9 in sass_compiler_parse /home/hongxu/FUZZ/libsass-orig/src/sass_context.cpp:483
    #24 0x7ff7e4944ec8 in sass_compile_context /home/hongxu/FUZZ/libsass-orig/src/sass_context.cpp:371
    #25 0x402d35 in compile_file /home/hongxu/FUZZ/sassc-orig/sassc.c:158
    #26 0x402456 in main /home/hongxu/FUZZ/sassc-orig/sassc.c:375
    #27 0x7ff7e411482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #28 0x402748 in _start (/home/hongxu/FUZZ/sassc-orig/install/bin/sassc+0x402748)

0x61400000ee08 is located 8 bytes to the right of 448-byte region [0x61400000ec40,0x61400000ee00)
allocated by thread T0 here:
    #0 0x7ff7e4ce0532 in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99532)
    #1 0x7ff7e46132c0 in __gnu_cxx::new_allocator<Sass::SharedImpl<Sass::Simple_Selector> >::allocate(unsigned long, void const*) /usr/include/c++/5/ext/new_allocator.h:104
    #2 0x7ff7e46132c0 in std::allocator_traits<std::allocator<Sass::SharedImpl<Sass::Simple_Selector> > >::allocate(std::allocator<Sass::SharedImpl<Sass::Simple_Selector> >&, unsigned long) /usr/include/c++/5/bits/alloc_traits.h:491
    #3 0x7ff7e46132c0 in std::_Vector_base<Sass::SharedImpl<Sass::Simple_Selector>, std::allocator<Sass::SharedImpl<Sass::Simple_Selector> > >::_M_allocate(unsigned long) /usr/include/c++/5/bits/stl_vector.h:170
    #4 0x7ff7e46132c0 in std::_Vector_base<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > >::_M_create_storage(unsigned long) /usr/include/c++/5/bits/stl_vector.h:185
    #5 0x7ff7e46132c0 in std::_Vector_base<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > >::_Vector_base(unsigned long, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > const&) /usr/include/c++/5/bits/stl_vector.h:136
    #6 0x7ff7e46132c0 in std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > >::vector(std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > const&) /usr/include/c++/5/bits/stl_vector.h:320
    #7 0x7ff7e46132c0 in Sass::Selector_List::operator==(Sass::Selector_List const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:467
    #8 0x7ff7e45f46fa in Sass::Wrapped_Selector::operator==(Sass::Wrapped_Selector const&) const /home/hongxu/FUZZ/libsass-orig/src/ast.cpp:797

SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/c++/5/bits/stl_algo.h:1935 void std::__introsort_loop<__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes> >(__gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, __gnu_cxx::__normal_iterator<Sass::SharedImpl<Sass::Complex_Selector>*, std::vector<Sass::SharedImpl<Sass::Complex_Selector>, std::allocator<Sass::SharedImpl<Sass::Complex_Selector> > > >, long, __gnu_cxx::__ops::_Iter_comp_iter<Sass::OrderNodes>)
Shadow bytes around the buggy address:
  0x0c287fff9d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9d80: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c287fff9d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c287fff9dc0: fa[fa]fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c287fff9dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c287fff9de0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c287fff9df0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c287fff9e00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c287fff9e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
==19419==ABORTING

Sample inputs:
bof_ast.cpp:469_01.txt
bof_ast.cpp:469_02.txt

[glebm]

This indeed got fixed by #2739

[xzyfer]

Thanks for the update