Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file.
cpe:2.3:a:yasm_project:yasm:1.3.0.78.g4dc8:*:*:*:*:*:*:*
0D988178-CCB8-439D-A35D-AF759EC16189
OR
 # Description
While fuzzing yasm, a SEGV occured which was positioned in yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy.
This bug may allow attackers to cause a crash or denial of service via a designed crafted files.
# Operating system
Ubuntu 20.04.6 LTS
# ASAN info
```
./bin/yasm -p gas -f elf32 -g dwarf2 ./out/default/crashes/id\:000035\,sig\:11\,src\:000071\,time\:10629\,execs\:3296\,op\:havoc\,rep\:4 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1770==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x555a0d6a722a bp 0x7fff3af67550 sp 0x7fff3af67530 T0)
==1770==The signal is caused by a READ memory access.
==1770==Hint: address points to the zero page.
    #0 0x555a0d6a722a in yasm_intnum_copy /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19
    #1 0x555a0d7b66b4 in elf_symtab_write_to_file /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf.c:485:25
    #2 0x555a0d7a723b in elf_objfmt_output /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf-objfmt.c:812:23
    #3 0x555a0d65e8cd in do_assemble /AFLplusplus/my_test/yasm/frontends/yasm/yasm.c:668:5
    #4 0x7feef6770d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #5 0x7feef6770e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #6 0x555a0d58e004 in _start (/AFLplusplus/my_test/fuzz_yasm/bin/yasm+0x183004) (BuildId: 74b4f28840ac06c5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy
==1770==ABORTING
```
# Steps to Reproduce
`./yasm -p gas -f elf32 -g dwarf2 $FILE `
# Poc
https://github.com/ChanStormstout/Pocs/blob/master/yasm_POC/out/default/crashes/id%3A000035%2Csig%3A11%2Csrc%3A000071%2Ctime%3A10629%2Cexecs%3A3296%2Cop%3Ahavoc%2Crep%3A4



SEGV in yasm/libyasm/intnum.c's function :yasm_intnum_copy
This is a GitHub Issue
repo:yasm
owner:yasm
Title : SEGV in yasm/libyasm/intnum.c's function :yasm_intnum_copy
Issue date:

--- start body ---
 # Description
While fuzzing yasm, a SEGV occured which was positioned in yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy.
This bug may allow attackers to cause a crash or denial of service via a designed crafted files.
# Operating system
Ubuntu 20.04.6 LTS
# ASAN info
```
./bin/yasm -p gas -f elf32 -g dwarf2 ./out/default/crashes/id\:000035\,sig\:11\,src\:000071\,time\:10629\,execs\:3296\,op\:havoc\,rep\:4 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1770==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x555a0d6a722a bp 0x7fff3af67550 sp 0x7fff3af67530 T0)
==1770==The signal is caused by a READ memory access.
==1770==Hint: address points to the zero page.
    #0 0x555a0d6a722a in yasm_intnum_copy /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19
    #1 0x555a0d7b66b4 in elf_symtab_write_to_file /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf.c:485:25
    #2 0x555a0d7a723b in elf_objfmt_output /AFLplusplus/my_test/yasm/modules/objfmts/elf/elf-objfmt.c:812:23
    #3 0x555a0d65e8cd in do_assemble /AFLplusplus/my_test/yasm/frontends/yasm/yasm.c:668:5
    #4 0x7feef6770d8f  (/lib/x86_64-linux-gnu/libc.so.6+0x29d8f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #5 0x7feef6770e3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e3f) (BuildId: 69389d485a9793dbe873f0ea2c93e02efaa9aa3d)
    #6 0x555a0d58e004 in _start (/AFLplusplus/my_test/fuzz_yasm/bin/yasm+0x183004) (BuildId: 74b4f28840ac06c5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /AFLplusplus/my_test/yasm/libyasm/intnum.c:399:19 in yasm_intnum_copy
==1770==ABORTING
```
# Steps to Reproduce
`./yasm -p gas -f elf32 -g dwarf2 $FILE `
# Poc
https://github.com/ChanStormstout/Pocs/blob/master/yasm_POC/out/default/crashes/id%3A000035%2Csig%3A11%2Csrc%3A000071%2Ctime%3A10629%2Cexecs%3A3296%2Cop%3Ahavoc%2Crep%3A4



--- end body ---

comments :
--- start comments ---

--- end comments ---