An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.
cpe:2.3:a:yasm_project:yasm:1.3.0.86.g9def:*:*:*:*:*:*:*
C9D63BD2-36F6-440B-AC78-6F48EDDC12CD
OR
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.

**Vulnerability Type**
segmentation violation

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13465912/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN Info**
````
yasm: file name already has no extension: output will be in `yasm.out'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4490==ERROR: AddressSanitizer: SEGV on unknown address 0x60ffffffffc8 (pc 0x00000056d207 bp 0x7ffd39055dc0 sp 0x7ffd39055740 T0)
==4490==The signal is caused by a READ memory access.
    #0 0x56d207 in expand_mmac_params /yasm/modules/preprocs/nasm/nasm-pp.c:4013:47
    #1 0x5685cf in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5079:21
    #2 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #3 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #4 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #5 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #6 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #7 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #8 0x7f79d306fc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /yasm/modules/preprocs/nasm/nasm-pp.c:4013:47 in expand_mmac_params
==4490==ABORTING
````

**Source Code**
````
    4009                                   tt = mac->params[n];
    4010                               }
    4011                               if (tt)
    4012                               {
--->4013                                   for (i = 0; i < mac->paramlen[n]; i++)
    4014                                   {
    4015                                       *tail =
    4016                                               new_Token(NULL, tt->type, tt->text,
    4017                                               0);
    4018                                       tail = &(*tail)->next;
````
SEGV in the function expand_mmac_params() at modules/preprocs/nasm/nasm-pp.c:4013
This is a GitHub Issue
repo:yasm
owner:yasm
Title : SEGV in the function expand_mmac_params() at modules/preprocs/nasm/nasm-pp.c:4013
Issue date:

--- start body ---
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the expand_mmac_params function in the modules/preprocs/nasm/nasm-pp.c component.

**Vulnerability Type**
segmentation violation

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13465912/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN Info**
````
yasm: file name already has no extension: output will be in `yasm.out'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4490==ERROR: AddressSanitizer: SEGV on unknown address 0x60ffffffffc8 (pc 0x00000056d207 bp 0x7ffd39055dc0 sp 0x7ffd39055740 T0)
==4490==The signal is caused by a READ memory access.
    #0 0x56d207 in expand_mmac_params /yasm/modules/preprocs/nasm/nasm-pp.c:4013:47
    #1 0x5685cf in pp_getline /yasm/modules/preprocs/nasm/nasm-pp.c:5079:21
    #2 0x56151b in nasm_preproc_get_line /yasm/modules/preprocs/nasm/nasm-preproc.c:203:12
    #3 0x551395 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:219:13
    #4 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #5 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #6 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #7 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #8 0x7f79d306fc86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #9 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /yasm/modules/preprocs/nasm/nasm-pp.c:4013:47 in expand_mmac_params
==4490==ABORTING
````

**Source Code**
````
    4009                                   tt = mac->params[n];
    4010                               }
    4011                               if (tt)
    4012                               {
--->4013                                   for (i = 0; i < mac->paramlen[n]; i++)
    4014                                   {
    4015                                       *tail =
    4016                                               new_Token(NULL, tt->type, tt->text,
    4017                                               0);
    4018                                       tail = &(*tail)->next;
````
--- end body ---

comments :
--- start comments ---

--- end comments ---