{"action":"closed","issue":{"url":"https://api.github.com/repos/sass/libsass/issues/2665","repository_url":"https://api.github.com/repos/sass/libsass","labels_url":"https://api.github.com/repos/sass/libsass/issues/2665/labels{/name}","comments_url":"https://api.github.com/repos/sass/libsass/issues/2665/comments","events_url":"https://api.github.com/repos/sass/libsass/issues/2665/events","html_url":"https://github.com/sass/libsass/issues/2665","id":328793721,"node_id":"MDU6SXNzdWUzMjg3OTM3MjE=","number":2665,"title":"AddressSanitizer: null pointer dereference (SEGV) in Sass::Inspect::operator (libsass/src/inspect.cpp:1060:9)","user":{"login":"glen-mac","id":6212082,"node_id":"MDQ6VXNlcjYyMTIwODI=","avatar_url":"https://avatars2.githubusercontent.com/u/6212082?v=4","gravatar_id":"","url":"https://api.github.com/users/glen-mac","html_url":"https://github.com/glen-mac","followers_url":"https://api.github.com/users/glen-mac/followers","following_url":"https://api.github.com/users/glen-mac/following{/other_user}","gists_url":"https://api.github.com/users/glen-mac/gists{/gist_id}","starred_url":"https://api.github.com/users/glen-mac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/glen-mac/subscriptions","organizations_url":"https://api.github.com/users/glen-mac/orgs","repos_url":"https://api.github.com/users/glen-mac/repos","events_url":"https://api.github.com/users/glen-mac/events{/privacy}","received_events_url":"https://api.github.com/users/glen-mac/received_events","type":"User","site_admin":false},"labels":[{"id":194880177,"node_id":"MDU6TGFiZWwxOTQ4ODAxNzc=","url":"https://api.github.com/repos/sass/libsass/labels/Dev%20-%20PR%20Ready","name":"Dev - PR Ready","color":"00FF00","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-03T02:39:40Z","updated_at":"2018-07-04T11:00:53Z","closed_at":"2018-07-04T11:00:53Z","author_association":"NONE","body":"Hey there, I have discovered a null pointer dereference in libsass at: [inspect.cpp:1060:9](https://github.com/sass/libsass/blob/60f839158eff1f1bb84cb44f0f0c4bce3ed86a6d/src/inspect.cpp#L1060)\r\n\r\nFound when fuzzing commit 60f839158eff1f1bb84cb44f0f0c4bce3ed86a6d of libsass, using commit [aa6d5c6](https://github.com/sass/sassc/commit/aa6d5c635ea8faf44d542a23aaf85d27e5777d48) of sassc as a harness.\r\n\r\nCompile flags to reproduce: \r\n```\r\nCC=clang CXX=clang++ CFLAGS='-fsanitize=address -g -O2 -fno-omit-frame-pointer' CXXFLAGS=$CFLAGS make -C sassc -j8\r\n```\r\n\r\nSystem information:\r\n```\r\n$ uname -a\r\nLinux s127422 3.13.0-137-generic #186-Ubuntu SMP Mon Dec 4 19:09:19 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n\r\nThis bug was found to be in libsass releases from [3.3.2](https://github.com/sass/libsass/tree/3.3.2) until the commit fuzzed (60f839158eff1f1bb84cb44f0f0c4bce3ed86a6d).\r\n\r\nYou can find a collection of PoC files that trigger the bug [here](https://github.com/sass/libsass/files/2065584/inspect_crashes.zip)\r\n\r\nThe full ASAN report is shown below:\r\n```\r\n↳ ./sassc.bin < crash.file\r\nASAN:DEADLYSIGNAL\r\n=================================================================\r\n==30272==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000818883 bp 0x7fffec548770 sp 0x7fffec548520 T0)\r\n    #0 0x818882 in Sass::Inspect::operator()(Sass::Complex_Selector*) /home/glenn/temp/libsass/src/inspect.cpp:1060:9\r\n    #1 0x818c95 in Sass::Inspect::operator()(Sass::Complex_Selector*) /home/glenn/temp/libsass/src/inspect.cpp:1076:15\r\n    #2 0x819902 in Sass::Inspect::operator()(Sass::Selector_List*) /home/glenn/temp/libsass/src/inspect.cpp:1113:7\r\n    #3 0x7fa9df in Sass::Output::operator()(Sass::Ruleset*) /home/glenn/temp/libsass/src/output.cpp:138:12\r\n    #4 0x80029f in Sass::Inspect::operator()(Sass::Block*) /home/glenn/temp/libsass/src/inspect.cpp:32:7\r\n    #5 0x54cc72 in Sass::Context::render(Sass::SharedImpl<Sass::Block>) /home/glenn/temp/libsass/src/context.cpp:506:5\r\n    #6 0x5209d8 in sass_compiler_execute /home/glenn/temp/libsass/src/sass_context.cpp:506:44\r\n    #7 0x51f6e1 in sass_compile_context(Sass_Context*, Sass::Context*) /home/glenn/temp/libsass/src/sass_context.cpp:376:7\r\n    #8 0x51707d in compile_stdin /home/glenn/temp/findsass/sassc/sassc.c:138:5\r\n    #9 0x517a8e in main /home/glenn/temp/findsass/sassc/sassc.c:375:18\r\n    #10 0x7fa62309282f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291\r\n    #11 0x4456d8 in _start (/home/glenn/temp/findsass/sassc.bin+0x4456d8)\r\n\r\nAddressSanitizer can not provide additional info.\r\nSUMMARY: AddressSanitizer: SEGV /home/glenn/temp/libsass/src/inspect.cpp:1060:9 in Sass::Inspect::operator()(Sass::Complex_Selector*)\r\n==30272==ABORTING\r\n```"}}
{"actor":{"display_login":"xzyfer"}}