[Tinycc-devel] Out of Bounds Write in sym_pop

[bugs-syssec]

Dear all,

While fuzzing tcc, an out of bounds write was found in the sym_pop 
function.

Attached are a file producing a crash when compiled and the output of 
the clang address sanitizer and valgrind.

The asan report only shows an out of bounds read, valgrind also shows 
the out of bounds write.

There are multiple inputs leading to the same crash,
they are included in the attached file as comments.

To reproduce, compile the attached input file with tcc

    tcc sym_pop-oob_read.c

The latest git version of tcc (commit 
c4787e3626904fc542bd640cc368a9d306347008) was tested.


Credits: SysSec chair of Ruhr University Bochum

asan.txt
Description: Text document

sym_pop-oob_write.c
Description: Binary data

valgrind.txt
Description: Text document