| Title | FascinatedBox lily main branch Use After Free |
|---|
| Description | ### Description
We discovered a Heap-use-after-free vulnerability in the Lily interpreter. The crash occurs when shorthash_for_name attempts to access a string pointer pointing into the lexer's source buffer, which has just been freed/moved by a realloc in grow_source_buffer.
This is a classic pointer invalidation issue where a pointer to the source code buffer is held while an operation triggers the buffer to grow and move.
### Environment
- OS: Linux x86_64
- Complier: Clang
- Build Configuration: Release mode with ASan enabled.
### Vulnerability Details
- Target: Lily (jcowgar/lily)
- Vulnerability Type: CWE-416: Use After Free
- Function: shorthash_for_name
- Location: src/lily_symtab.c:521 (Usage) / src/lily_lexer.c:124 (Free via realloc)
- Root Cause Analysis:
1. The parser is processing an expression (expr_word) and likely holds a pointer to the current token's text, which resides inside the Lexer's source_buffer.
2. The logic triggers resolve_module (as seen in the "Freed by" stack trace), which calls lily_next_token to read more input.
3. lily_next_token calls read_line. If the line is long or the buffer is full, grow_source_buffer is called.
4. grow_source_buffer calls realloc. If realloc moves the memory block, the original buffer is freed.
5. The control flow returns to expr_word, which proceeds to call lily_find_var -> shorthash_for_name using the original (now dangling) pointer into the old buffer.
### Reproduce
1. Build lily with Release optimization and ASAN enabled.
2. Run with the crashing [file](https://github.com/oneafter/0122/blob/main/i385/repro.lily):
```
./build/lily repro.lily
```
<details>
<summary>ASAN report</summary>
```
==87409==ERROR: AddressSanitizer: heap-use-after-free on address 0x50c000000100 at pc 0x5623382cd8cc bp 0x7ffcfa29d800 sp 0x7ffcfa29d7f8
READ of size 1 at 0x50c000000100 thread T0
#0 0x5623382cd8cb in shorthash_for_name /src/lily/src/lily_symtab.c:521:10
#1 0x5623382cd8cb in lily_find_var /src/lily/src/lily_symtab.c:596:26
#2 0x562338275bc3 in find_existing_sym /src/lily/src/lily_parser.c:648:26
#3 0x562338275bc3 in expr_word /src/lily/src/lily_parser.c:2745:19
#4 0x56233828214f in expression_raw /src/lily/src/lily_parser.c:3242:9
#5 0x56233828214f in keyword_var /src/lily/src/lily_parser.c:3643:9
#6 0x562338262efb in parser_loop /src/lily/src/lily_parser.c:5946:17
#7 0x562338260be9 in lily_parse_content /src/lily/src/lily_parser.c:6562:9
#8 0x5623381d137e in main /src/lily/run/lily.c:103:18
#9 0x7fecc3f041c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#10 0x7fecc3f0428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#11 0x5623380ef624 in _start (/src/lily/build_afl/lily+0x4f624) (BuildId: ec5f784cf13dad836217a07e33a2c98d8b7f8bb4)
0x50c000000100 is located 0 bytes inside of 128-byte region [0x50c000000100,0x50c000000180)
freed by thread T0 here:
#0 0x56233818f870 in realloc (/src/lily/build_afl/lily+0xef870) (BuildId: ec5f784cf13dad836217a07e33a2c98d8b7f8bb4)
#1 0x5623381d35e5 in lily_realloc /src/lily/src/lily_alloc.c:14:20
#2 0x562338238447 in grow_source_buffer /src/lily/src/lily_lexer.c:124:21
#3 0x562338238447 in read_file_line /src/lily/src/lily_lexer.c:188:9
#4 0x562338238447 in read_line /src/lily/src/lily_lexer.c:265:16
#5 0x562338239bf8 in lily_next_token /src/lily/src/lily_lexer.c:1405:17
#6 0x562338275a83 in resolve_module /src/lily/src/lily_parser.c:1740:9
#7 0x562338275a83 in expr_word /src/lily/src/lily_parser.c:2744:17
#8 0x56233828214f in expression_raw /src/lily/src/lily_parser.c:3242:9
#9 0x56233828214f in keyword_var /src/lily/src/lily_parser.c:3643:9
#10 0x562338262efb in parser_loop /src/lily/src/lily_parser.c:5946:17
#11 0x562338260be9 in lily_parse_content /src/lily/src/lily_parser.c:6562:9
#12 0x5623381d137e in main /src/lily/run/lily.c:103:18
#13 0x7fecc3f041c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#14 0x7fecc3f0428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#15 0x5623380ef624 in _start (/src/lily/build_afl/lily+0x4f624) (BuildId: ec5f784cf13dad836217a07e33a2c98d8b7f8bb4)
previously allocated by thread T0 here:
#0 0x56233818f453 in malloc (/src/lily/build_afl/lily+0xef453) (BuildId: ec5f784cf13dad836217a07e33a2c98d8b7f8bb4)
#1 0x5623381d3533 in lily_malloc /src/lily/src/lily_alloc.c:5:20
#2 0x562338233bd2 in lily_new_lex_state /src/lily/src/lily_lexer.c:32:18
#3 0x5623382538cf in lily_new_state /src/lily/src/lily_parser.c:190:19
#4 0x5623381d130f in main /src/lily/run/lily.c:90:25
#5 0x7fecc3f041c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#6 0x7fecc3f0428a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 274eec488d230825a136fa9c4d85370fed7a0a5e)
#7 0x5623380ef624 in _start (/src/lily/build_afl/lily+0x4f624) (BuildId: ec5f784cf13dad836217a07e33a2c98d8b7f8bb4)
SUMMARY: AddressSanitizer: heap-use-after-free /src/lily/src/lily_symtab.c:521:10 in shorthash_for_name
Shadow bytes around the buggy address:
0x50bffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50bfffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50bfffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x50c000000000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x50c000000080: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa
=>0x50c000000100:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x50c000000180: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x50c000000200: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
0x50c000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50c000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x50c000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==87409==ABORTING
```
</details> |
|---|
| Source | ⚠️ https://github.com/FascinatedBox/lily/issues/385 |
|---|
| User | Oneafter (UID 92781) |
|---|
| Submission | 02/06/2026 04:29 (4 months ago) |
|---|
| Moderation | 02/18/2026 08:27 (12 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 346458 [FascinatedBox lily up to 2.3 src/lily_symtab.c shorthash_for_name use after free] |
|---|
| Points | 20 |
|---|