[Tinycc-devel] Out of Bounds Write in asm_parse_directive

[bugs-syssec]

Dear all,

An out of bounds write in the asm_parse_directive function was found 
while fuzzing tcc.

You can find the input producing the crash and the output of the clang 
address sanitizer and valgrind in the attachments.
The input file contains four lines, each of which triggered the bug on 
my system.
The ASAN output was generated on an older version of Ubuntu (16.04),
but I could also reproduce the crashes on a current Arch Linux.

To reproduce, compile the attached input file with tcc

    tcc asm_parse-oob_write.c

I tested the latest git version of tcc (commit 
c4787e3626904fc542bd640cc368a9d306347008).

Credits: SysSec chair of Ruhr University Bochum

asm_parse-oob_write.c
Description: Text document

valgrind.txt
Description: Text document

asan.txt
Description: Text document