Submit #623197: nasm NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab) Memory Corruption

# NASM Global Buffer Overflow Vulnerability in dbgdbg_typevalue Function (Variant 2)

## Vulnerability Summary

A high-severity global buffer overflow vulnerability has been discovered in the NASM (Netwide Assembler) debug output format module. This is a distinct variant of the global buffer overflow occurring in the `dbgdbg_typevalue` function within `outdbg.c` at line 460, with a different trigger pattern than the first variant.

## Technical Details

- **Vulnerability Type**: Global Buffer Overflow
- **Affected Function**: `dbgdbg_typevalue`
- **Source File**: `outdbg.c`
- **Line Number**: 460
- **Signal**: SIGABRT (6)

## Vulnerability Mechanism and Root Cause

This global buffer overflow vulnerability is caused by insufficient bounds checking when processing debug type information in the debug output format, similar to variant 1 but triggered through a different input pattern. The root issue lies in the `dbgdbg_typevalue` function where global arrays or buffers used for debug symbol processing are accessed beyond their allocated boundaries.

The vulnerability occurs when:
1. The `dbgdbg_typevalue` function processes debug type information for assembly symbols with different data patterns
2. Global buffers used for type value processing encounter different boundary conditions
3. Malformed debug directives or alternative type information formats cause a READ operation of size 8 bytes beyond the allocated global buffer boundary
4. This reads from adjacent global memory regions, potentially exposing sensitive data or causing crashes
5. The buffer overflow can lead to information disclosure or program instability

This variant demonstrates that multiple input patterns can trigger the same underlying buffer overflow vulnerability in the debug output module.

## AddressSanitizer Report

```
=================================================================
==[PID]==ERROR: AddressSanitizer: global-buffer-overflow detected
READ of size 8 at 0x[ADDR] thread T0
#0 0x[ADDR] in dbgdbg_typevalue /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/output/outdbg.c:460:13
#1 0x[ADDR] in debug_set_db_type /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/assemble.c:995:5
#2 0x[ADDR] in insn_size /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/assemble.c:1118:9
#3 0x[ADDR] in process_insn /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:1610:17
#4 0x[ADDR] in assemble_file /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:1749:13
#5 0x[ADDR] in main /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:716:9

Global variable access beyond allocated boundaries in dbgdbg_typevalue function.

SUMMARY: AddressSanitizer: global-buffer-overflow /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/output/outdbg.c:460:13 in dbgdbg_typevalue
```

## Proof of Concept

The vulnerability can be triggered by processing the malformed assembly file provided as `POC_nasm_global_buffer_overflow_dbgdbg_typevalue_2`. This file contains alternative debug directives that cause the global buffer overflow condition through a different execution path.

**POC Download**: [Google Drive Link - POC_nasm_global_buffer_overflow_dbgdbg_typevalue_2](https://drive.google.com/file/d/1yC4JbO50aoCcu_VXqoexhVGHvSqjmVWq/view?usp=drive_link)

## Reproduction Steps

1. Compile NASM with AddressSanitizer enabled
2. Execute: `nasm -f dbg POC_nasm_global_buffer_overflow_dbgdbg_typevalue_2`
3. The program will crash with a global-buffer-overflow error

## Affected Versions

NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab)

**Credit**
- Xudong Cao (UCAS)
- Yuqing Zhang (UCAS, Zhongguancun Laboratory)

• Source: ⚠️ https://bugzilla.nasm.us/show_bug.cgi?id=3392941
• User: xdcao (UID 88377)
• Submission: 07/26/2025 09:13 (1 Year ago)
• Moderation: 08/10/2025 20:58 (15 days later)
• Status: Duplicate
• VulDB entry: 217413 [NASM 2.16 /output/outdbg.c dbgdbg_typevalue buffer overflow]
• Points: 0