While fuzzing the "FuzzShellPosix" binary, a DoS attack has been discovered in ParseLexer.cpp::reduce_start. The bug is reproducible with the Base64-encoded input PDwAAAAAAAAAAAAAAAAKCg==. When running the FuzzShellPosix binary with the input, it crashes with the following error message:
FuzzShellPosix: /root/build/serenity/Meta/Lagom/../../AK/Vector.h:148: AK::Vector::VisibleType &AK::Vector<Shell::Posix::Token, 0>::at(size_t) [T = Shell::Posix::Token, inline_capacity = 0]: Assertion `i < m_size' failed.
The root cause is the mis-handling the returned value from Token::maybe_from_state. The returned vector could be empty, thus the access to the the elements (.first() in this case) should be checked first.
serenity/Userland/Shell/PosixLexer.cpp
Line 575 in 4f496e9
How does funding with Polar work?
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
Backer
You're funding impactful open source efforts
Contributor
You want to contribute to this effort
Maintainer
You want to get funding like this too