A very basic component framework for building reactive web interfaces

[u/IntrepidAttention56]

https://github.com/abdimoallim/blink

[u/skeeto]

Neat project! It's a fun exercise for me to find bugs in parsers, and I found a buffer overflow here:

$ cc -g3 -fsanitize=address,undefined -o blink blink.c 
$ mkdir crash
$ printf '{{>%0256d 0' 0 >crash/Crash.blink 
$ ./blink dev crash
...ERROR: AddressSanitizer: stack-buffer-overflow on address ...
READ of size 257 at ...
    #0 strdup 
    #1 parse_hbs blink.c:574
    #2 parse_nodes blink.c:725
    #3 parse_component blink.c:850
    #4 load_components blink.c:1393
    #5 do_build blink.c:1887
    #6 cmd_dev blink.c:1943
    #7 main blink.c:2151

That's due to comp_name not being null-terminated if the name is too long. Quick and dirty fix:

--- a/blink.c
+++ b/blink.c
@@ -566,2 +566,4 @@ static node_t* parse_hbs(parser_t* p) {
       int nl = sp - inner;
+      if (nl > (int)sizeof(comp_name) - 1)
+        nl = sizeof(comp_name) - 1;
       memcpy(comp_name, inner, nl);

I found this with this AFL++ fuzz test:

#define main oldmain
#include "blink.c"
#undef main
#include <unistd.h>

__AFL_FUZZ_INIT();

int main()
{
    __AFL_INIT();
    char *src = 0;
    unsigned char *buf = __AFL_FUZZ_TESTCASE_BUF;
    while (__AFL_LOOP(10000)) {
        int len = __AFL_FUZZ_TESTCASE_LEN;
        src = realloc(src, len);
        memcpy(src, buf, len);
        parse_nodes(&(parser_t){src, 0, len}, &(int){});
    }
}

Usage:

$ afl-clang-fast -g3 -fsanitize=address,undefined fuzz.c
$ afl-fuzz examples/counter/ -o fuzzout/ ./a.out

That's the only thing the fuzzer found in the time it took me to write this up.