Submit #907499: github markdown commit 0d1eafb484f4766316a5391e162b4c96dc76513f Out-of-Bounds Read

Title: Heap-buffer-overflow (out-of-bounds read) in lds() at end-of-input

Product: 92181/markdown
Vulnerable: commit 0d1eafb484f4766316a5391e162b4c96dc76513f
Fixed: commit 6de2cc18d41b9a75cb044ef1cf16b43a98e6ccc0
Fix PR: https://github.com/92181/markdown/pull/2

A heap-based out-of-bounds read vulnerability exists in the lds() function
(md.c:136) of the 92181/markdown parser at commit 0d1eafb. When parsing
input ending with a newline, the parser reads one byte past the allocated
heap buffer boundary.

Root Cause: In example/main.c the input is read into a buffer allocated
exactly via malloc(s). Inside psr(), lds() advances pointer 'b' through
the buffer without bounds checking and dereferences *b beyond end of
buffer when input ends with a newline.

Minimal reproducer:
printf '\n' > poc.md
./markdown_asan poc.md

Realistic input:
printf -- '- item1\n- item2\n- item3\n' > poc.md
./markdown_asan poc.md

AddressSanitizer output:
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1
#0 in lds md.c:136:9
#1 in psr md.c:397:19
#2 in main example/main.c:35:5
0x603000000058 is located 0 bytes to the right of 24-byte region

Fix: Added boundary check in lds() function: while(*b < end && **b == ' ')
instead of while(**b == ' ')

Impact: Information disclosure (heap memory read), Denial of Service (crash).

Discovered via: Fuzz testing with AddressSanitizer instrumentation.
Reported: 2026-07-17 by 1820893135-pixel (Issue #1)
Fixed: 2026-07-18 by 1820893135-pixel (PR #2)
Merged: 2026-07-18 by 92181

References:
- https://github.com/92181/markdown/issues/1
- https://github.com/92181/markdown/pull/2
- https://github.com/92181/markdown/commit/0d1eafb
- https://github.com/92181/markdown/commit/6de2cc1

• Source: ⚠️ https://github.com/92181/markdown/issues/1
• User: lrrh (UID 100159)
• Submission: 07/28/2026 09:12 (1 month ago)
• Moderation: 09/06/2026 18:49 (1 month later)
• Status: Accepted
• VulDB entry: 399467 [92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f md.c lds out-of-bounds]
• Points: 20