LibSass: null pointer dereference in Sass::Eval::operator()(Sass::Map*)

Feeding...

LibSass: stack overflow #5 in libsass

./sassc test099 /dev/null triggers this stack overflow. ==9395==ERROR: AddressSanitizer: stack-overflow on address 0x7fff5d9a4e48 pc 0x000000584c3a bp 0x7fff5d9a56b0 sp 0x7fff5d9a4e50 T0 0 0x584c39 in asanmemset /home/geeknik/sassc/bin/sassc+0x584c39 1 0x83b798 in Sass::Parser::advanceToNextToken...

LibSass: stack overflow #4 in libsass

./sassc test385 /dev/null triggers this stack overflow. ==1001==ERROR: AddressSanitizer: stack-overflow on address 0x7ffeaf4f4fa0 pc 0x0000008b63fd bp 0x7ffeaf4f5130 sp 0x7ffeaf4f4f40 T0 0 0x8b63fc in char const Sass::Parser::lexbool, bool /home/geeknik/libsass/src/parser.hpp:137 1 0x87a337 in...

LibSass: stack overflow #3 in libsass

./sassc test387 /dev/null triggers this stack overflow. ==9081==ERROR: AddressSanitizer: stack-overflow on address 0x7fffb48eadc0 pc 0x00000087a07b bp 0x7fffb48eba30 sp 0x7fffb48ead60 T0 0 0x87a07a in Sass::Parser::parsefactor /home/geeknik/libsass/src/parser.cpp:1379 1 0x878304 in...

LibSass: stack overflow #2 in libsass

By pasting 0g:00;m:0 into ./sassc -s we're able to trigger this stack overflow. ==28845==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd55d71a88 pc 0x000000584802 bp 0x7ffd55d722f0 sp 0x7ffd55d71a90 T0 0 0x584801 in asanmemcpy /home/geeknik/sassc/bin/sassc+0x584801 1 0x7c1df3 in...

LibSass: stack overflow in libsass

By pasting @H into ./sassc -s, we're able to trigger this stack overflow. ==3470==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe1b09ffc8 pc 0x00000059bc77 bp 0x7ffe1b0a0820 sp 0x7ffe1b09ffd0 T0 0 0x59bc76 in interceptormalloc /home/geeknik/sassc/bin/sassc+0x59bc76 1 0x7f842fedb2e7 in...

LibSass: heap-buffer-overflow (read outside of buffer) in Sass::Prelexer::exactly<(char)92>(char const*) - libsass/src/lexer.hpp:92

Built with afl-clang-fast from git source 5909ba5. Feeding a file that contains nothing but '\ to sassc triggers this flaw. ==22006==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ef93 at pc 0x000000907c6a bp 0x7fff656d9430 sp 0x7fff656d9428 READ of size 1 at 0x60200000ef93...

LibSass: type confusion in Sass::ParserState::ParserState(Sass::ParserState const&)

I haven't actually spent much time on the bug, because it doesn't look super exploitable outside of a local DoS, but the attached PoC will crash sassc in the middle of libsass from latest git, trying to deref $0x8, which appears to be the value of some tag in a tagged union. Let me know if I can...