| タイトル | albertodemichelis squirrel master-branch Heap-based Buffer Overflow |
|---|
| 説明 | ### Description
We discovered a Heap-buffer-overflow vulnerability in the Squirrel compiler. The crash occurs in SQFuncState::PopTarget() when parsing complex expressions involving binary or logical operations inside statements (e.g., for loops).
The ASAN report indicates a READ violation of 8 bytes located 8 bytes before the allocated heap region. This strongly suggests the compiler is attempting to access a vector/stack at index -1 (Buffer Underflow), likely due to popping from an empty target stack.
### Environment
- OS: Linux x86_64
- Complier: Clang
- Build Configuration: Release mode with ASan enabled.
### Vulnerability Details
- Target: Squirrel (squirrel-lang)
- Vulnerability Type: CWE-125: Out-of-bounds Read (Underflow)
- Function: SQFuncState::PopTarget()
- Location: src/squirrel/squirrel/sqfuncstate.cpp:290
- Root Cause Analysis: The function PopTarget retrieves the last element from _target_stack.
```
// Example logic in sqfuncstate.cpp
long long PopTarget() {
// If _target_stack is empty, size() is 0.
// Accessing index [0 - 1] leads to a heap underflow of 8 bytes (sizeof long long).
return _target_stack.back();
}
```
The ASAN report shows the crash happened after a deep recursion of Expression -> LogicalAndExp -> BitwiseOrExp -> BIN_EXP. It appears the compiler's internal state tracking of expression targets gets desynchronized, causing PopTarget to be called one time too many, resulting in an access to _target_stack[-1].
### Reproduce
1. Build squirrel with Release optimization and ASAN enabled.
2. Run with the crashing [file](https://github.com/oneafter/0122/blob/main/i311/repro):
```
./build/bin/sq repro
```
<details>
<summary>ASAN report</summary>
```
==57882==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x503000002378 at pc 0x7f3958ffda7c bp 0x7fff9612d060 sp 0x7fff9612d058
READ of size 8 at 0x503000002378 thread T0
#0 0x7f3958ffda7b in SQFuncState::PopTarget() /src/squirrel/squirrel/sqfuncstate.cpp:290:41
#1 0x7f3958fe666c in void SQCompiler::BIN_EXP<void (SQCompiler::*)()>(SQOpcode, void (SQCompiler::*)(), long long) /src/squirrel/squirrel/sqcompiler.cpp:469:63
#2 0x7f3958fe666c in SQCompiler::BitwiseOrExp() /src/squirrel/squirrel/sqcompiler.cpp:520:10
#3 0x7f3958fe666c in SQCompiler::LogicalAndExp() /src/squirrel/squirrel/sqcompiler.cpp:494:9
#4 0x7f3958fe547d in SQCompiler::LogicalOrExp() /src/squirrel/squirrel/sqcompiler.cpp:475:9
#5 0x7f3958fe455c in SQCompiler::Expression() /src/squirrel/squirrel/sqcompiler.cpp:377:9
#6 0x7f3958fdf9dc in SQCompiler::CommaExpr() /src/squirrel/squirrel/sqcompiler.cpp:369:13
#7 0x7f3958fd5edb in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:311:13
#8 0x7f3958fd5d22 in SQCompiler::Statements() /src/squirrel/squirrel/sqcompiler.cpp:205:13
#9 0x7f3958fd5d22 in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:279:17
#10 0x7f3958fdb1d3 in SQCompiler::ForStatement() /src/squirrel/squirrel/sqcompiler.cpp:1190:9
#11 0x7f3958fd653d in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:217:29
#12 0x7f3958fd5d22 in SQCompiler::Statements() /src/squirrel/squirrel/sqcompiler.cpp:205:13
#13 0x7f3958fd5d22 in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:279:17
#14 0x7f3958ff5752 in SQCompiler::CreateFunction(tagSQObject&, long long, bool) /src/squirrel/squirrel/sqcompiler.cpp:1580:13
#15 0x7f3958fe01f4 in SQCompiler::FunctionStatement() /src/squirrel/squirrel/sqcompiler.cpp:1318:9
#16 0x7f3958fd641c in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:268:13
#17 0x7f3958fd5d22 in SQCompiler::Statements() /src/squirrel/squirrel/sqcompiler.cpp:205:13
#18 0x7f3958fd5d22 in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:279:17
#19 0x7f3958fdb1d3 in SQCompiler::ForStatement() /src/squirrel/squirrel/sqcompiler.cpp:1190:9
#20 0x7f3958fd653d in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:217:29
#21 0x7f3958fd5d22 in SQCompiler::Statements() /src/squirrel/squirrel/sqcompiler.cpp:205:13
#22 0x7f3958fd5d22 in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:279:17
#23 0x7f3958ff5752 in SQCompiler::CreateFunction(tagSQObject&, long long, bool) /src/squirrel/squirrel/sqcompiler.cpp:1580:13
#24 0x7f3958fe01f4 in SQCompiler::FunctionStatement() /src/squirrel/squirrel/sqcompiler.cpp:1318:9
#25 0x7f3958fd641c in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:268:13
#26 0x7f3958fd5d22 in SQCompiler::Statements() /src/squirrel/squirrel/sqcompiler.cpp:205:13
#27 0x7f3958fd5d22 in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:279:17
#28 0x7f3958ff5752 in SQCompiler::CreateFunction(tagSQObject&, long long, bool) /src/squirrel/squirrel/sqcompiler.cpp:1580:13
#29 0x7f3958fe01f4 in SQCompiler::FunctionStatement() /src/squirrel/squirrel/sqcompiler.cpp:1318:9
#30 0x7f3958fd641c in SQCompiler::Statement(bool) /src/squirrel/squirrel/sqcompiler.cpp:268:13
#31 0x7f3958fd48b0 in SQCompiler::Compile(SQObjectPtr&) /src/squirrel/squirrel/sqcompiler.cpp:180:17
#32 0x7f3958fd38f6 in Compile(SQVM*, long long (*)(void*), void*, char const*, SQObjectPtr&, bool, bool) /src/squirrel/squirrel/sqcompiler.cpp:1633:14
#33 0x7f3958f7f358 in sq_compile /src/squirrel/squirrel/sqapi.cpp:131:8
#34 0x7f39590f0b92 in sqstd_loadfile /src/squirrel/sqstdlib/sqstdio.cpp:389:16
#35 0x556bb0e12411 in getargs /src/squirrel/sq/sq.c
#36 0x556bb0e13cb7 in main /src/squirrel/sq/sq.c:330:12
#37 0x7f3958c311c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#38 0x7f3958c3128a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#39 0x556bb0d30634 in _start (/src/squirrel/build/bin/sq+0x2d634) (BuildId: e84909622778a60c07bbbd32568cd4522dcfe97d)
0x503000002378 is located 8 bytes before 32-byte region [0x503000002380,0x5030000023a0)
allocated by thread T0 here:
#0 0x556bb0dd0880 in realloc (/src/squirrel/build/bin/sq+0xcd880) (BuildId: e84909622778a60c07bbbd32568cd4522dcfe97d)
#1 0x7f3958ffd56e in sqvector<long long>::_realloc(unsigned long long) /src/squirrel/squirrel/squtils.h:110:21
#2 0x7f3958ffd56e in sqvector<long long>::push_back(long long const&) /src/squirrel/squirrel/squtils.h:79:13
#3 0x7f3958ffd56e in SQFuncState::PushTarget(long long) /src/squirrel/squirrel/sqfuncstate.cpp
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/squirrel/squirrel/sqfuncstate.cpp:290:41 in SQFuncState::PopTarget()
Shadow bytes around the buggy address:
0x503000002080: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
0x503000002100: fa fa 00 00 00 00 fa fa fd fd fd fd fa fa 00 00
0x503000002180: 00 00 fa fa 00 00 00 00 fa fa fd fd fd fd fa fa
0x503000002200: 00 00 00 00 fa fa fd fd fd fd fa fa fd fd fd fd
0x503000002280: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
=>0x503000002300: 00 00 fa fa fd fd fd fd fa fa 00 00 00 00 fa[fa]
0x503000002380: 00 00 00 00 fa fa fd fd fd fd fa fa 00 00 00 00
0x503000002400: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa fa fa
0x503000002480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000002500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x503000002580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==57882==ABORTING
```
</details> |
|---|
| ソース | ⚠️ https://github.com/albertodemichelis/squirrel/issues/311 |
|---|
| ユーザー | Oneafter (UID 92781) |
|---|
| 送信 | 2026年02月06日 04:28 (4 月 ago) |
|---|
| モデレーション | 2026年02月18日 08:20 (12 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 346457 [Squirrel 迄 3.2 sqfuncstate.cpp SQFuncState::PopTarget _target_stack 情報漏えい] |
|---|
| ポイント | 20 |
|---|