| 标题 | github markdown commit 0d1eafb484f4766316a5391e162b4c96dc76513f Out-of-Bounds Read |
|---|
| 描述 | Title: Heap-buffer-overflow (out-of-bounds read) in lds() at end-of-input
Product: 92181/markdown
Vulnerable: commit 0d1eafb484f4766316a5391e162b4c96dc76513f
Fixed: commit 6de2cc18d41b9a75cb044ef1cf16b43a98e6ccc0
Fix PR: https://github.com/92181/markdown/pull/2
A heap-based out-of-bounds read vulnerability exists in the lds() function
(md.c:136) of the 92181/markdown parser at commit 0d1eafb. When parsing
input ending with a newline, the parser reads one byte past the allocated
heap buffer boundary.
Root Cause: In example/main.c the input is read into a buffer allocated
exactly via malloc(s). Inside psr(), lds() advances pointer 'b' through
the buffer without bounds checking and dereferences *b beyond end of
buffer when input ends with a newline.
Minimal reproducer:
printf '\n' > poc.md
./markdown_asan poc.md
Realistic input:
printf -- '- item1\n- item2\n- item3\n' > poc.md
./markdown_asan poc.md
AddressSanitizer output:
ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1
#0 in lds md.c:136:9
#1 in psr md.c:397:19
#2 in main example/main.c:35:5
0x603000000058 is located 0 bytes to the right of 24-byte region
Fix: Added boundary check in lds() function: while(*b < end && **b == ' ')
instead of while(**b == ' ')
Impact: Information disclosure (heap memory read), Denial of Service (crash).
Discovered via: Fuzz testing with AddressSanitizer instrumentation.
Reported: 2026-07-17 by 1820893135-pixel (Issue #1)
Fixed: 2026-07-18 by 1820893135-pixel (PR #2)
Merged: 2026-07-18 by 92181
References:
- https://github.com/92181/markdown/issues/1
- https://github.com/92181/markdown/pull/2
- https://github.com/92181/markdown/commit/0d1eafb
- https://github.com/92181/markdown/commit/6de2cc1 |
|---|
| 来源 | ⚠️ https://github.com/92181/markdown/issues/1 |
|---|
| 用户 | lrrh (UID 100159) |
|---|
| 提交 | 2026-07-28 09時12分 (1 月前) |
|---|
| 管理 | 2026-09-06 18時49分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 399467 [92181 markdown 直到 058cab0cb7fb245a0ccc6b8446963ff8d573558f md.c lds 信息公开] |
|---|
| 积分 | 20 |
|---|