提交 #623388: GNU cflow cflow cflow (GNU cflow) the newest master (0a19319e282506ff88d19e630380cd5069e893ed ) in cflow.git - GNU cflow Array Bounds Violation

## Summary
A critical array bounds violation vulnerability exists in GNU cflow's lexical analyzer (`yylex()`) function. When processing malformed C source files, the program fails to properly validate array indices for the `yy_accept` array, leading to out-of-bounds memory access and segmentation fault.

## Vulnerability Details

**Program**: cflow (GNU cflow)
**Crash Type**: SIGSEGV (Signal 11)
**Root Cause**: Array bounds violation in yylex() lexical analyzer
**Trigger**: Malformed C source code input causing invalid state machine indices

## Technical Analysis

### Stack Trace Pattern
```gdb
Program received signal SIGSEGV, Segmentation fault.
0x000055555556488d in yylex () at c.c:1091
1091 if ( yy_accept[yy_current_state] )

#0 0x000055555556488d in yylex () at c.c:1091
#1 get_token () at /src/c.l:385
#2 0x0000555555575d85 in nexttoken () at parser.c:299
#3 is_function () at parser.c:622
#4 0x000055555556fb3c in parse_declaration (ident=0x7fffffffe250, parm=0) at parser.c:645
#5 yyparse () at /src/parser.c:596
#6 main (argc=<optimized out>, argv=<optimized out>) at main.c:1457
```

### Vulnerability Mechanism

**Critical Assembly Code**:
```assembly
0x55555556488d <get_token+845>: cmpw $0x0,(%rbx,%rax,2) ; CRASH HERE
0x555555564892 <get_token+850>: je 0x5555555648c0 <get_token+896>
```

**Register Analysis**:
- `rax = 0x2f3a7366` (792359782) - Corrupted state value representing invalid array index
- `rbx = 0x55555555c000` - Base address of `yy_accept` array
- Instruction attempts: `cmpw $0x0,(%rbx,%rax,2)` = access `yy_accept[792359782]`
- Results in access to invalid memory address far beyond array boundaries

### Root Cause Analysis

1. **Input Processing**: cflow parses C source files using flex-generated lexical analyzer
2. **State Machine Corruption**: Malformed input causes `yy_current_state` variable to be set to invalid value (792359782)
3. **Unchecked Array Access**: Code uses corrupted state value directly as array index without bounds checking
4. **Memory Violation**: Out-of-bounds access to `yy_accept[792359782]` triggers segmentation fault

### Vulnerable Code Context
```c
// In yylex() at c.c:1091
if ( yy_accept[yy_current_state] ) // Vulnerable array access
{
(yy_last_accepting_state) = yy_current_state;
(yy_last_accepting_cpos) = yy_cp;
}
```

The vulnerability occurs when:
- Input contains malformed C constructs that confuse the lexer state machine
- `yy_current_state` becomes corrupted with extremely large values (like 792359782)
- No bounds checking before using state as index into `yy_accept[]` array
- Results in memory access far beyond valid array boundaries

## Impact Assessment

**Attack Vector**: Local file processing
**Prerequisites**: Attacker-controlled C source file

### Potential Impact:
- **Denial of Service**: Immediate program crash via SIGSEGV
- **Code Analysis Disruption**: Breaks automated source code analysis workflows
- **Security Tool Bypass**: Could prevent security analysis of malicious code

## Reproduction Steps

### Command Line Test
```bash
# Execute vulnerable command with POC file
./cflow -p 0 --tree POC_cflow_yylex_array_bounds_1091
```

### Expected Behavior
The command will:
1. Begin parsing the malformed C source file
2. Enter lexical analysis phase in yylex()
3. Encounter corrupted state value (792359782)
4. Attempt to access yy_accept[792359782] - far beyond array bounds
5. Crash with SIGSEGV at array bounds violation

## Distinction from Other CFLOW Vulnerabilities

This vulnerability is **distinct** from the previously reported vulnerabilities:

### Key Differences:
| Aspect | Buffer Overflow (bug-cflow/2025-07/msg00001.html) | Null Dereference (bug-cflow/2025-07/msg00000.html) | Array Bounds (This Report) |
|--------|--------------------------------|--------------------------------|----------------------------|
| **Crash Location** | `c.c:1096` | `c.c:1086` | `c.c:1091` |
| **Assembly** | `cmpw $0x0,(%rbx,%rax,2)` | `mov 0x28(%rax),%edx` | `cmpw $0x0,(%rbx,%rax,2)` |
| **RAX Value** | `0x6f6c6673` (ASCII "sfol") | `0x0` (NULL) | `0x2f3a7366` (792359782) |
| **Root Cause** | State corruption with ASCII | Null pointer dereference | Invalid array index |

All three vulnerabilities occur in the same `yylex()` function but at different lines and with different corruption patterns.

### Technical Signatures:
- **yy_current_state**: 792359782 (0x2f3a7366)
- **Assembly Pattern**: `cmpw $0x0,(%rbx,%rax,2)` at line 1091
- **Memory Access**: Invalid array bounds in yy_accept[] table

## Proof of Concept

**POC File**: `POC_cflow_yylex_array_bounds_1091` [https://drive.google.com/file/d/1txoqx85O9IX0yim9l7jESV3qBv8V3DsL/view?usp=drive_link]

## Fix Recommendation

The vulnerability can be mitigated by adding bounds checking before array access:

```c
// Proposed fix at c.c:1091
if (yy_current_state >= 0 && yy_current_state < YY_ACCEPT_SIZE &&
yy_accept[yy_current_state])
{
(yy_last_accepting_state) = yy_current_state;
(yy_last_accepting_cpos) = yy_cp;
}
```

## References

**Affected Versions**: cflow (GNU cflow) the newest master (0a19319e282506ff88d19e630380cd5069e893ed ) in cflow.git - GNU cflow

### Credit
Xudong Cao (UCAS)
Yuqing Zhang (UCAS, Zhongguancun Laboratory)

• 来源: ⚠️ https://lists.gnu.org/archive/html/bug-cflow/2025-07/msg00003.html
• 用户: nipc-cxd (UID 88335)
• 提交: 2025-07-26 11時59分 (1 年前)
• 管理: 2025-08-10 23時13分 (15 days later)
• 状态: 重复
• VulDB条目: 319232 [GNU cflow 直到 1.8 Lexer c.c yylex 内存损坏]
• 积分: 0