Bug 1040917 (CVE-2016-10375)

https://github.com/fbb-git/yodl/issues/1

Compiling yodl with address sanitizer (-fsanitize=address) shows an invalid memory read in the function queue_push().

==19388==ERROR: AddressSanitizer: unknown-crash on address 0x61400000ee40 at pc 0x418d47 bp 0x7ffe39342bc0 sp 0x7ffe39342bb0
READ of size 613 at 0x61400000ee40 thread T0
    #0 0x418d46 in queue_push /tmp/yodl-3.05.01/src/queue/queuepush.c:51
    #1 0x41436d in lexer_push_str /tmp/yodl-3.05.01/src/lexer/lexerpushstr.c:28
    #2 0x41c6b0 in p_expand_macro /tmp/yodl-3.05.01/src/parser/pexpandmacro.c:51
    #3 0x41c0d7 in p_default_symbol /tmp/yodl-3.05.01/src/parser/pdefaultesymbol.c:20
    #4 0x4167b3 in p_handle_default_symbol /tmp/yodl-3.05.01/src/parser/phandledefaultsymbol.c:5
    #5 0x40dd26 in p_parse /tmp/yodl-3.05.01/src/parser/pparse.c:18
    #6 0x40cbe6 in parser_process /tmp/yodl-3.05.01/src/parser/parserprocess.c:39
    #7 0x407e5a in main /tmp/yodl-3.05.01/src/yodl/yodl.c:14
    #8 0x7f0ed56d761f in __libc_start_main (/lib64/libc.so.6+0x2061f)
    #9 0x401e28 in _start (/tmp/yodl-3.05.01/tmp/install/usr/bin/yodl+0x401e28)

0x61400000efd7 is located 0 bytes to the right of 407-byte region [0x61400000ee40,0x61400000efd7)
allocated by thread T0 here:
    #0 0x7f0ed5aab7d7 in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.3/libasan.so.1+0x577d7)
    #1 0x409c4b in n_malloc /tmp/yodl-3.05.01/src/new/nmalloc.c:11
    #2 0x418533 in new_memory ../new/new.h:42
    #3 0x4185e1 in queue_construct /tmp/yodl-3.05.01/src/queue/queueconstruct.c:11
    #4 0x41499b in l_media_construct_memory /tmp/yodl-3.05.01/src/lexer/lmediaconstructmemory.c:9
    #5 0x4150a8 in l_push /tmp/yodl-3.05.01/src/lexer/lpush.c:15
    #6 0x414171 in lexer_push_str /tmp/yodl-3.05.01/src/lexer/lexerpushstr.c:20
    #7 0x41c6b0 in p_expand_macro /tmp/yodl-3.05.01/src/parser/pexpandmacro.c:51
    #8 0x41c0d7 in p_default_symbol /tmp/yodl-3.05.01/src/parser/pdefaultesymbol.c:20
    #9 0x4167b3 in p_handle_default_symbol /tmp/yodl-3.05.01/src/parser/phandledefaultsymbol.c:5
    #10 0x40dd26 in p_parse /tmp/yodl-3.05.01/src/parser/pparse.c:18
    #11 0x40cbe6 in parser_process /tmp/yodl-3.05.01/src/parser/parserprocess.c:39
    #12 0x407e5a in main /tmp/yodl-3.05.01/src/yodl/yodl.c:14
    #13 0x7f0ed56d761f in __libc_start_main (/lib64/libc.so.6+0x2061f)

SUMMARY: AddressSanitizer: unknown-crash /tmp/yodl-3.05.01/src/queue/queuepush.c:51 queue_push
Shadow bytes around the buggy address:
  0x0c287fff9d70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
  0x0c287fff9d80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c287fff9d90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c287fff9da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c287fff9db0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
=>0x0c287fff9dc0: fa fa fa fa fa fa fa fa[00]00 00 00 00 00 00 00
  0x0c287fff9dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c287fff9df0: 00 00 00 00 00 00 00 00 00 00 07 fa fa fa fa fa
  0x0c287fff9e00: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c287fff9e10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==19388==ABORTING



Fixed in https://github.com/fbb-git/yodl/commit/fd85f8c94182558ff1480d06a236d6fb927979a3
Unknown effect, likely DoS through specially crafted files at most.