Gửi #623195: nasm NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab) Memory Corruption

# NASM Global Buffer Overflow Vulnerability in dbgdbg_typevalue Function

## Vulnerability Summary

A high-severity global buffer overflow vulnerability has been discovered in the NASM (Netwide Assembler) debug output format module. The vulnerability occurs in the `dbgdbg_typevalue` function within `outdbg.c` at line 460, where the program reads beyond the bounds of a global buffer.

## Technical Details

- **Vulnerability Type**: Global Buffer Overflow
- **Affected Function**: `dbgdbg_typevalue`
- **Source File**: `outdbg.c`
- **Line Number**: 460
- **Signal**: SIGABRT (6)

## Vulnerability Mechanism and Root Cause

This global buffer overflow vulnerability is caused by insufficient bounds checking when processing debug type information in the debug output format. The root issue lies in the `dbgdbg_typevalue` function where global arrays or buffers used for debug symbol processing are accessed beyond their allocated boundaries.

The vulnerability occurs when:
1. The `dbgdbg_typevalue` function processes debug type information for assembly symbols
2. Global buffers used for type value processing are not properly bounds-checked
3. Malformed debug directives or excessive type information causes a READ operation of size 8 bytes beyond the allocated global buffer boundary
4. This reads from adjacent global memory regions, potentially exposing sensitive data or causing crashes
5. The buffer overflow can lead to information disclosure or program instability

The vulnerability is triggered by assembly files that contain malformed or excessive debug information directives when using the debug output format.

## AddressSanitizer Report

```
=================================================================
==797067==ERROR: AddressSanitizer: global-buffer-overflow on address 0x560445a05050 at pc 0x5604458be744 bp 0x7ffd7a02d3a0 sp 0x7ffd7a02d398
READ of size 8 at 0x560445a05050 thread T0
#0 0x5604458be743 in dbgdbg_typevalue /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/output/outdbg.c:460:13
#1 0x56044579aebc in debug_set_db_type /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/assemble.c:995:5
#2 0x56044579aebc in insn_size /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/assemble.c:1118:9
#3 0x56044574182b in process_insn /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:1610:17
#4 0x56044574182b in assemble_file /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:1749:13
#5 0x56044574182b in main /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/nasm.c:716:9
#6 0x7f363cdd4d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#7 0x7f363cdd4e3f in __libc_start_main csu/../csu/libc-start.c:392:3
#8 0x5604456707b4 in _start (/workspace/benchmark/tmp/old-fuzzdir/fz-nasm/fz-nasm/nasm+0x1ed7b4) (BuildId: 2a14aa05a80be476)

0x560445a05050 is located 16 bytes after global variable 'types' defined in '/workspace/benchmark/program/nasm-888d9ab-Nov5-2024/output/outdbg.c:411' (0x560445a05000) of size 64
0x560445a05050 is located 16 bytes before global variable 'directive_tbl' defined in '/workspace/benchmark/program/nasm-888d9ab-Nov5-2024/asm/directbl.c:8' (0x560445a05060) of size 320

SUMMARY: AddressSanitizer: global-buffer-overflow /workspace/benchmark/program/nasm-888d9ab-Nov5-2024/output/outdbg.c:460:13 in dbgdbg_typevalue
```

## Proof of Concept

The vulnerability can be triggered by processing the malformed assembly file provided as `POC_nasm_global_buffer_overflow_dbgdbg_typevalue_1`. This file contains specific debug directives that cause the global buffer overflow condition.

**POC Download**: [Google Drive Link - POC_nasm_global_buffer_overflow_dbgdbg_typevalue_1](https://drive.google.com/file/d/1Ay_aH2VKxrZ8i_xrxmoRkU-A_ZJZWFpp/view?usp=drive_link)

## Reproduction Steps

1. Compile NASM with AddressSanitizer enabled
2. Execute: `nasm -f dbg POC_nasm_global_buffer_overflow_dbgdbg_typevalue_1`
3. The program will crash with a global-buffer-overflow error

## Affected Versions

NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab)

**Credit**
- Xudong Cao (UCAS)
- Yuqing Zhang (UCAS, Zhongguancun Laboratory)

• Nguồn: ⚠️ https://bugzilla.nasm.us/show_bug.cgi?id=3392939
• Người dùng: xdcao (UID 88377)
• Đệ trình: 26/07/2025 09:13 (cách đây 1 Năm)
• Kiểm duyệt: 10/08/2025 20:56 (15 days later)
• Trạng thái: Bản sao
• Mục VulDB: 217413 [NASM 2.16 /output/outdbg.c dbgdbg_typevalue tràn bộ đệm]
• điểm: 0