radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*
6F2CC41D-F155-4528-AB57-DD94A54A0CE4
4.0.0
OR
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
97A4B8DF-58DA-4AB6-A1F9-331B36409BA3
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
80F0FA5D-8D3B-4C0E-81E2-87998286AF33
OR
### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | None
| Architecture/bits of the file (mandatory)            | None
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.1.0-git 23530 @ linux-x86-64 git.4.0.0-174-gb7cc6999a commit: b7cc6999ac0bfaff51039af960ac86b2e6bb1c91 build: 2019-12-05__21:51:53

### Expected behavior

```bash
$ r2 malloc://1024
[0x00000000]> /a .incbin NoExistFile 0 0  # Expect No Crash
```

### Actual behavior

```bash
$ r2 malloc://1024
[0x00000000]> /a .incbin NoExistFile 0 0 
Segmentation fault
```

### Steps to reproduce the behavior 
- Please follow the steps I list above

### Additional Logs, screenshots, source-code,  configuration dump, ...

At [libr/asm/asm.c](https://github.com/radareorg/radare2/blob/204b7317beb1ede1ba352b13f7ebb09efff1c55d/libr/asm/asm.c#L157),  the lack of validation check of variable [content](https://github.com/radareorg/radare2/blob/204b7317beb1ede1ba352b13f7ebb09efff1c55d/libr/asm/asm.c#L165) will cause crash and arbitrary read via craft input.

below is the vulnerable code.

```c
static inline int r_asm_pseudo_incbin(RAsmOp *op, char *input) {
	int bytes_read = 0;
	r_str_replace_char (input, ',', ' ');
	// int len = r_str_word_count (input);
	r_str_word_set0 (input);
	//const char *filename = r_str_word_get0 (input, 0);
	int skip = (int)r_num_math (NULL, r_str_word_get0 (input, 1));
	int count = (int)r_num_math (NULL,r_str_word_get0 (input, 2));
	char *content = r_file_slurp (input, &bytes_read);
	if (skip > 0) {
		skip = skip > bytes_read ? bytes_read : skip;
	}
	if (count > 0) {
		count = count > bytes_read ? 0 : count;
	} else {
		count = bytes_read;
	}
	// Need to handle arbitrary amount of data
	r_buf_free (op->buf_inc);
	op->buf_inc = r_buf_new_with_string (content + skip);
	// Terminate the original buffer
	free (content);
	return count;
}
``` 

If `r_file_slurp` tries to open an invalid file, `content` will be NULL. Later, because `skip` is the input number, `r_buf_new_with_string (content + skip)` will cause crash, or arbitrary write via crafted input.
Lack of Validation Check for `r_asm_pseudo_incbin` at `libr/asm/asm.c`
This is a GitHub Issue
repo:radare2
owner:radareorg
Title : Lack of Validation Check for `r_asm_pseudo_incbin` at `libr/asm/asm.c`
Issue date:

--- start body ---
### Work environment

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | None
| Architecture/bits of the file (mandatory)            | None
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.1.0-git 23530 @ linux-x86-64 git.4.0.0-174-gb7cc6999a commit: b7cc6999ac0bfaff51039af960ac86b2e6bb1c91 build: 2019-12-05__21:51:53

### Expected behavior

```bash
$ r2 malloc://1024
[0x00000000]> /a .incbin NoExistFile 0 0  # Expect No Crash
```

### Actual behavior

```bash
$ r2 malloc://1024
[0x00000000]> /a .incbin NoExistFile 0 0 
Segmentation fault
```

### Steps to reproduce the behavior 
- Please follow the steps I list above

### Additional Logs, screenshots, source-code,  configuration dump, ...

At [libr/asm/asm.c](https://github.com/radareorg/radare2/blob/204b7317beb1ede1ba352b13f7ebb09efff1c55d/libr/asm/asm.c#L157),  the lack of validation check of variable [content](https://github.com/radareorg/radare2/blob/204b7317beb1ede1ba352b13f7ebb09efff1c55d/libr/asm/asm.c#L165) will cause crash and arbitrary read via craft input.

below is the vulnerable code.

```c
static inline int r_asm_pseudo_incbin(RAsmOp *op, char *input) {
	int bytes_read = 0;
	r_str_replace_char (input, ',', ' ');
	// int len = r_str_word_count (input);
	r_str_word_set0 (input);
	//const char *filename = r_str_word_get0 (input, 0);
	int skip = (int)r_num_math (NULL, r_str_word_get0 (input, 1));
	int count = (int)r_num_math (NULL,r_str_word_get0 (input, 2));
	char *content = r_file_slurp (input, &bytes_read);
	if (skip > 0) {
		skip = skip > bytes_read ? bytes_read : skip;
	}
	if (count > 0) {
		count = count > bytes_read ? 0 : count;
	} else {
		count = bytes_read;
	}
	// Need to handle arbitrary amount of data
	r_buf_free (op->buf_inc);
	op->buf_inc = r_buf_new_with_string (content + skip);
	// Terminate the original buffer
	free (content);
	return count;
}
``` 

If `r_file_slurp` tries to open an invalid file, `content` will be NULL. Later, because `skip` is the input number, `r_buf_new_with_string (content + skip)` will cause crash, or arbitrary write via crafted input.
--- end body ---

comments :
--- start comments ---

--- end comments ---