cflow 1.7 stack-overflow in yylex

[j.c.jiang]

Hello, cflow developers.

During a fuzzing experiment, there exists a stack-overflow in yylex because of recursive call of dcl and dirdcl at cflow-1.7/src/parser.c.

It seems to be caused by infinite left brackets.

Environment

- OS: Ubuntu 18.04.

- clang: Ubuntu clang version 12.0.1-++20211102090516+fed41342a82f-1~exp1~20211102211019.11

- cflow: 1.7

Command to Reproduce

wget https://ftp.gnu.org/gnu/cflow/cflow-1.7.tar.gz

tar -xzf cflow-1.7.tar.gz

cd cflow-1.7

CC=clang \

    CXX=clang++ \

    CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \

    CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \

    ./configure

make -j $(nproc)

unzip poc.zip

src/cflow poc

Asan Info

AddressSanitizer:DEADLYSIGNAL

=================================================================

==5001==ERROR: AddressSanitizer: stack-overflow on address 0x7ffca627afa0 (pc 0x0000004cf7e6 bp 0x7ffca627c070 sp 0x7ffca627aea0 T0)

    #0 0x4cf7e6 in yylex /cflow-1.7/src/c.l:169:1

    #1 0x4d5796 in get_token /cflow-1.7/src/c.l:380:17

    #2 0x4e1690 in nexttoken /cflow-1.7/src/parser.c:298:11

    #3 0x4e59b0 in dcl /cflow-1.7/src/parser.c:907:13

    #4 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #5 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #6 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #7 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #8 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #9 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #10 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #11 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #12 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #13 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #14 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #15 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #16 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #17 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #18 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #19 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #20 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #21 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #22 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #23 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #24 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #25 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #26 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #27 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #28 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #29 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #30 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #31 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #32 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #33 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #34 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #35 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #36 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #37 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #38 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #39 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #40 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #41 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #42 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #43 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #44 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #45 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #46 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #47 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #48 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #49 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #50 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #51 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #52 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #53 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #54 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #55 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #56 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #57 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #58 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #59 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #60 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #61 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #62 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #63 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #64 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #65 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #66 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #67 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #68 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #69 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #70 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #71 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #72 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #73 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #74 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #75 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #76 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #77 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #78 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #79 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #80 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #81 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #82 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #83 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #84 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #85 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #86 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #87 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #88 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #89 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #90 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #91 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #92 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #93 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #94 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #95 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #96 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #97 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #98 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #99 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #100 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #101 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #102 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #103 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #104 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #105 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #106 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #107 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #108 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #109 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #110 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #111 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #112 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #113 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #114 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #115 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #116 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #117 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #118 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #119 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #120 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #121 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #122 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #123 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #124 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #125 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #126 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #127 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #128 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #129 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #130 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #131 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #132 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #133 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #134 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #135 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #136 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #137 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #138 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #139 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #140 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #141 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #142 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #143 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #144 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #145 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #146 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #147 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #148 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #149 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #150 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #151 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #152 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #153 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #154 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #155 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #156 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #157 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #158 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #159 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #160 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #161 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #162 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #163 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #164 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #165 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #166 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #167 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #168 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #169 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #170 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #171 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #172 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #173 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #174 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #175 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #176 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #177 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #178 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #179 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #180 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #181 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #182 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #183 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #184 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #185 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #186 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #187 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #188 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #189 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #190 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #191 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #192 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #193 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #194 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #195 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #196 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #197 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #198 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #199 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #200 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #201 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #202 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #203 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #204 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #205 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #206 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #207 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #208 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #209 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #210 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #211 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #212 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #213 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #214 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #215 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #216 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #217 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #218 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #219 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #220 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #221 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #222 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #223 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #224 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #225 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #226 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #227 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #228 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #229 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #230 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #231 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #232 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #233 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #234 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #235 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #236 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #237 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #238 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #239 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #240 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #241 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #242 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #243 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #244 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #245 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #246 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

    #247 0x4e5c84 in dcl /cflow-1.7/src/parser.c:934:13

    #248 0x4e71d1 in dirdcl /cflow-1.7/src/parser.c:944:4

SUMMARY: AddressSanitizer: stack-overflow /cflow-1.7/src/c.l:169:1 in yylex

==5001==ABORTING

Many Thanks.

poc.zip
Description: Binary data