Submit #623196: nasm NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab) Memory Corruption

# NASM Segmentation Fault Vulnerability in parse_smacro_template Function (Variant 2)

## Vulnerability Summary

A high-severity segmentation fault vulnerability has been discovered in the NASM (Netwide Assembler) preprocessor module. This is a distinct variant of the segmentation fault occurring in the `parse_smacro_template` function within `preproc.c` at line 3054, with a different execution context and trigger mechanism.

## Technical Details

- **Vulnerability Type**: Segmentation Fault
- **Affected Function**: `parse_smacro_template`
- **Source File**: `preproc.c`
- **Line Number**: 3054
- **Signal**: SIGSEGV (11)

## Vulnerability Mechanism and Root Cause

This segmentation fault vulnerability is caused by a null pointer dereference or invalid memory access in the macro template parsing logic, similar to variant 1 but triggered through a different code path. The root issue lies in the `parse_smacro_template` function where insufficient validation of pointer values leads to an attempt to access memory at address 0x000000000001.

The vulnerability occurs when:
1. The `parse_smacro_template` function processes malformed macro template definitions with different syntax patterns
2. Invalid macro parameter specifications with garbage strings like "referencstart" and "r64tsz"
3. Unterminated string literals and malformed radix specifiers cause parsing state corruption
4. A recursive call to `parse_smacro_template` at line 3025 processes the corrupted state
5. Eventually, at line 3054, the program attempts to read memory from address 0x000000000001
6. This address points to the zero page, resulting in a segmentation fault

This variant differs from the first in that it's triggered through the error handling path with the `-e` option, indicating different input validation pathways can lead to the same underlying bug.

## AddressSanitizer Report

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==877598==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000001 (pc 0x5579be32a47f bp 0x7ffe97071170 sp 0x7ffe97071060 T0)
==877598==The signal is caused by a READ memory access.
==877598==Hint: address points to the zero page.
#0 0x5579be32a47f in parse_smacro_template /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:3054:46
#1 0x5579be329d18 in parse_smacro_template /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:3025:18
#2 0x5579be31435d in do_directive /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:4880:18
#3 0x5579be302692 in pp_tokline /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:8069:13
#4 0x5579be302692 in pp_getline /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:8133:17
#5 0x5579be259c4d in main /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:654:28
#6 0x7fdf8f72ad8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#7 0x7fdf8f72ae3f in __libc_start_main csu/../csu/libc-start.c:392:3
#8 0x5579be18a7b4 in _start (/workspace/benchmark/tmp/old-fuzzdir/fz-nasm/fz-nasm/nasm+0x1ed7b4) (BuildId: 2a14aa05a80be476)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/preproc.c:3054:46 in parse_smacro_template
```

## Proof of Concept

The vulnerability can be triggered by processing the malformed assembly file provided as `POC_nasm_segmentation_fault_parse_smacro_template_2`. This file contains specific macro template definitions that cause the segmentation fault condition through the error handling code path.

**POC Download**: [Google Drive Link - POC_nasm_segmentation_fault_parse_smacro_template_2](https://drive.google.com/file/d/1MOmGYffqNexpmAy8I8LrnzteH-ES0yMs/view?usp=drive_link)

## Reproduction Steps

1. Compile NASM with AddressSanitizer enabled
2. Execute: `nasm -f dbg -e POC_nasm_segmentation_fault_parse_smacro_template_2`
3. The program will crash with a segmentation fault error

## Affected Versions

NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab)

**Credit**
- Xudong Cao (UCAS)
- Yuqing Zhang (UCAS, Zhongguancun Laboratory)

• Source: ⚠️ https://bugzilla.nasm.us/show_bug.cgi?id=3392940
• User: xdcao (UID 88377)
• Submission: 07/26/2025 09:13 (1 Year ago)
• Moderation: 08/10/2025 20:57 (15 days later)
• Status: Duplicate
• VulDB entry: 319378 [NASM Netwide Assember 2.17rc0 preproc.c parse_smacro_template null pointer dereference]
• Points: 0