An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.
cpe:2.3:a:yasm_project:yasm:1.3.0.86.g9def:*:*:*:*:*:*:*
C9D63BD2-36F6-440B-AC78-6F48EDDC12CD
OR
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.

**Vulnerability Type**
segmentation violation

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13466305/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN Info**
````
yasm: file name already has no extension: output will be in `yasm.out'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4485==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040 (pc 0x0000004fe6c6 bp 0x7ffdc1e64920 sp 0x7ffdc1e64910 T0)
==4485==The signal is caused by a READ memory access.
==4485==Hint: address points to the zero page.
    #0 0x4fe6c6 in yasm_section_bcs_first /yasm/libyasm/section.c:619:12
    #1 0x55ad2f in parse_expr6 /yasm/modules/parsers/nasm/nasm-parse.c:1486:21
    #2 0x55bbfd in parse_expr5 /yasm/modules/parsers/nasm/nasm-parse.c:1306:9
    #3 0x55b8ad in parse_expr4 /yasm/modules/parsers/nasm/nasm-parse.c:1278:9
    #4 0x55b54d in parse_expr3 /yasm/modules/parsers/nasm/nasm-parse.c:1250:9
    #5 0x55b36a in parse_expr2 /yasm/modules/parsers/nasm/nasm-parse.c:1243:5
    #6 0x55b18a in parse_expr1 /yasm/modules/parsers/nasm/nasm-parse.c:1237:5
    #7 0x55904a in parse_expr0 /yasm/modules/parsers/nasm/nasm-parse.c:1231:5
    #8 0x558e6a in parse_bexpr /yasm/modules/parsers/nasm/nasm-parse.c:1225:5
    #9 0x55f2af in parse_operand /yasm/modules/parsers/nasm/nasm-parse.c:1043:28
    #10 0x554545 in parse_instr /yasm/modules/parsers/nasm/nasm-parse.c:751:41
    #11 0x55511f in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:566:10
    #12 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #13 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #14 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #15 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #16 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #17 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #18 0x7f2094cb4c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #19 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /yasm/libyasm/section.c:619:12 in yasm_section_bcs_first
==4485==ABORTING
````

**Source Code**
````c
    616    yasm_bytecode *
    617    yasm_section_bcs_first(yasm_section *sect)
    618    {
--->619        return STAILQ_FIRST(&sect->bcs);
    620    }
    621    
    622    yasm_bytecode *
    623    yasm_section_bcs_last(yasm_section *sect)
    624    {
````
SEGV in yasm_section_bcs_first() at libyasm/section.c:619
This is a GitHub Issue
repo:yasm
owner:yasm
Title : SEGV in yasm_section_bcs_first() at libyasm/section.c:619
Issue date:

--- start body ---
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm/section.c component.

**Vulnerability Type**
segmentation violation

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13466305/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN Info**
````
yasm: file name already has no extension: output will be in `yasm.out'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4485==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000040 (pc 0x0000004fe6c6 bp 0x7ffdc1e64920 sp 0x7ffdc1e64910 T0)
==4485==The signal is caused by a READ memory access.
==4485==Hint: address points to the zero page.
    #0 0x4fe6c6 in yasm_section_bcs_first /yasm/libyasm/section.c:619:12
    #1 0x55ad2f in parse_expr6 /yasm/modules/parsers/nasm/nasm-parse.c:1486:21
    #2 0x55bbfd in parse_expr5 /yasm/modules/parsers/nasm/nasm-parse.c:1306:9
    #3 0x55b8ad in parse_expr4 /yasm/modules/parsers/nasm/nasm-parse.c:1278:9
    #4 0x55b54d in parse_expr3 /yasm/modules/parsers/nasm/nasm-parse.c:1250:9
    #5 0x55b36a in parse_expr2 /yasm/modules/parsers/nasm/nasm-parse.c:1243:5
    #6 0x55b18a in parse_expr1 /yasm/modules/parsers/nasm/nasm-parse.c:1237:5
    #7 0x55904a in parse_expr0 /yasm/modules/parsers/nasm/nasm-parse.c:1231:5
    #8 0x558e6a in parse_bexpr /yasm/modules/parsers/nasm/nasm-parse.c:1225:5
    #9 0x55f2af in parse_operand /yasm/modules/parsers/nasm/nasm-parse.c:1043:28
    #10 0x554545 in parse_instr /yasm/modules/parsers/nasm/nasm-parse.c:751:41
    #11 0x55511f in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:566:10
    #12 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #13 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #14 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #15 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #16 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #17 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #18 0x7f2094cb4c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #19 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /yasm/libyasm/section.c:619:12 in yasm_section_bcs_first
==4485==ABORTING
````

**Source Code**
````c
    616    yasm_bytecode *
    617    yasm_section_bcs_first(yasm_section *sect)
    618    {
--->619        return STAILQ_FIRST(&sect->bcs);
    620    }
    621    
    622    yasm_bytecode *
    623    yasm_section_bcs_last(yasm_section *sect)
    624    {
````
--- end body ---

comments :
--- start comments ---

--- end comments ---