Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.
cpe:2.3:a:yasm_project:yasm:1.3.0.86.g9def:*:*:*:*:*:*:*
C9D63BD2-36F6-440B-AC78-6F48EDDC12CD
OR
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.

**Vulnerability Type**
Buffer Overflow

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13415866/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN info**
````
yasm: file name already has no extension: output will be in `yasm.out'
=================================================================
==4526==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000022498 at pc 0x00000062409c bp 0x7ffe67167c80 sp 0x7ffe67167c78
READ of size 4 at 0x606000022498 thread T0
    #0 0x62409b in expr_delete_term /yasm/libyasm/expr.c:1019:19
    #1 0x6239e8 in expr_simplify_identity /yasm/libyasm/expr.c:582:17
    #2 0x61cdde in expr_level_op /yasm/libyasm/expr.c:792:23
    #3 0x61e5e1 in expr_level_tree /yasm/libyasm/expr.c:881:9
    #4 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #5 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #6 0x61d892 in yasm_expr__level_tree /yasm/libyasm/expr.c:907:9
    #7 0x620539 in yasm_expr_get_intnum /yasm/libyasm/expr.c:1265:11
    #8 0x612914 in yasm_bc_create_data /yasm/libyasm/bc-data.c:357:24
    #9 0x5561cb in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:669:20
    #10 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #11 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #12 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #13 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #14 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #15 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #16 0x7f5599036c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #17 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

0x606000022498 is located 0 bytes to the right of 56-byte region [0x606000022460,0x606000022498)
allocated by thread T0 here:
    #0 0x496ba9 in realloc (/yasm/yasm+0x496ba9)
    #1 0x5157bc in def_xrealloc /yasm/libyasm/xmalloc.c:101:18
    #2 0x61c515 in expr_level_op /yasm/libyasm/expr.c:738:9
    #3 0x61e5e1 in expr_level_tree /yasm/libyasm/expr.c:881:9
    #4 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #5 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #6 0x61d892 in yasm_expr__level_tree /yasm/libyasm/expr.c:907:9
    #7 0x620539 in yasm_expr_get_intnum /yasm/libyasm/expr.c:1265:11
    #8 0x612914 in yasm_bc_create_data /yasm/libyasm/bc-data.c:357:24
    #9 0x5561cb in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:669:20
    #10 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #11 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #12 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #13 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #14 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #15 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #16 0x7f5599036c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /yasm/libyasm/expr.c:1019:19 in expr_delete_term
Shadow bytes around the buggy address:
  0x0c0c7fffc440: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffc450: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffc460: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fffc470: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffc480: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
=>0x0c0c7fffc490: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4526==ABORTING
````
heap-buffer-overflow in the function expr_delete_term() at libyasm/expr.c:1019
This is a GitHub Issue
repo:yasm
owner:yasm
Title : heap-buffer-overflow in the function expr_delete_term() at libyasm/expr.c:1019
Issue date:

--- start body ---
**The name of an affected Product**
[yasm](https://github.com/yasm/yasm)

**The affected version**
Commit: [9defefa](https://github.com/yasm/yasm/commit/9defefae9fbcb6958cddbfa778c1ea8605da8b8b)
yasm 1.3.0.86.g9def

**Description**
An issue in yasm 1.3.0.86.g9def allows a attacker to cause a denial of service via the expr_delete_term function in the libyasm/expr.c component.

**Vulnerability Type**
Buffer Overflow

**Environment**
- Operating System
````
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.6 LTS
Release:        18.04
Codename:       bionic
````
- Compiler
````
Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11
Target: x86_64-pc-linux-gnu
Thread model: posix
````

**Steps to Reproduce**
download [poc.zip](https://github.com/yasm/yasm/files/13415866/poc.zip), then
````
git clone https://github.com/yasm/yasm
cd yasm
git checkout 9defefa
./autogen.sh
make distclean
CC=clang \
    CXX=clang++ \
    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
    ./configure
make -j $(nproc)
unzip poc.zip 
# run command
./yasm poc
````

**ASAN info**
````
yasm: file name already has no extension: output will be in `yasm.out'
=================================================================
==4526==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606000022498 at pc 0x00000062409c bp 0x7ffe67167c80 sp 0x7ffe67167c78
READ of size 4 at 0x606000022498 thread T0
    #0 0x62409b in expr_delete_term /yasm/libyasm/expr.c:1019:19
    #1 0x6239e8 in expr_simplify_identity /yasm/libyasm/expr.c:582:17
    #2 0x61cdde in expr_level_op /yasm/libyasm/expr.c:792:23
    #3 0x61e5e1 in expr_level_tree /yasm/libyasm/expr.c:881:9
    #4 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #5 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #6 0x61d892 in yasm_expr__level_tree /yasm/libyasm/expr.c:907:9
    #7 0x620539 in yasm_expr_get_intnum /yasm/libyasm/expr.c:1265:11
    #8 0x612914 in yasm_bc_create_data /yasm/libyasm/bc-data.c:357:24
    #9 0x5561cb in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:669:20
    #10 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #11 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #12 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #13 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #14 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #15 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #16 0x7f5599036c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310
    #17 0x41b9c9 in _start (/yasm/yasm+0x41b9c9)

0x606000022498 is located 0 bytes to the right of 56-byte region [0x606000022460,0x606000022498)
allocated by thread T0 here:
    #0 0x496ba9 in realloc (/yasm/yasm+0x496ba9)
    #1 0x5157bc in def_xrealloc /yasm/libyasm/xmalloc.c:101:18
    #2 0x61c515 in expr_level_op /yasm/libyasm/expr.c:738:9
    #3 0x61e5e1 in expr_level_tree /yasm/libyasm/expr.c:881:9
    #4 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #5 0x61e290 in expr_level_tree /yasm/libyasm/expr.c:865:17
    #6 0x61d892 in yasm_expr__level_tree /yasm/libyasm/expr.c:907:9
    #7 0x620539 in yasm_expr_get_intnum /yasm/libyasm/expr.c:1265:11
    #8 0x612914 in yasm_bc_create_data /yasm/libyasm/bc-data.c:357:24
    #9 0x5561cb in parse_exp /yasm/modules/parsers/nasm/nasm-parse.c:669:20
    #10 0x551e07 in parse_line /yasm/modules/parsers/nasm/nasm-parse.c:289:10
    #11 0x5516e8 in nasm_parser_parse /yasm/modules/parsers/nasm/nasm-parse.c:231:18
    #12 0x550fdf in nasm_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:66:5
    #13 0x550985 in nasm_parser_do_parse /yasm/modules/parsers/nasm/nasm-parser.c:83:5
    #14 0x4ca7d6 in do_assemble /yasm/frontends/yasm/yasm.c:641:5
    #15 0x4c832e in main /yasm/frontends/yasm/yasm.c:877:12
    #16 0x7f5599036c86 in __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: heap-buffer-overflow /yasm/libyasm/expr.c:1019:19 in expr_delete_term
Shadow bytes around the buggy address:
  0x0c0c7fffc440: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffc450: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c7fffc460: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c7fffc470: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c7fffc480: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
=>0x0c0c7fffc490: 00 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0c7fffc4e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==4526==ABORTING
````
--- end body ---

comments :
--- start comments ---

--- end comments ---