A stack-buffer-overflow (stack exhaustion) vulnerability exists in the markdown parsing logic of discount. When processing a maliciously crafted markdown file with excessively nested structures, the compile() function inside markdown.c falls into an uncontrolled deep recursion. This ultimately exhausts the process stack space, causing the application to crash with a DEADLYSIGNAL (Segmentation Fault).
Trigger Condition: The program falls into an excessively deep recursion within the compile() function in markdown.c (line 1445).
./markdown -G crash00.md
Point of Crash: Deep within the recursion stack, compile() invokes the Pp() function (line 1443). Subsequently, Pp() attempts to allocate memory via calloc (line 1214), which triggers a stack-overflow exception caught by AddressSanitizer.
Suggested Mitigation
Introduce a MAX_NESTING_DEPTH constant (e.g., 100 or 200). Add a depth variable to the parsing context structure. Increment this counter before entering a recursive compile() call, and decrement it after returning. If the limit is reached, abort the deep parsing and treat the remaining data as plain text.
crash00.md
This stack exhaustion vulnerability was discovered by SynFuzz.
A stack-buffer-overflow (stack exhaustion) vulnerability exists in the markdown parsing logic of discount. When processing a maliciously crafted markdown file with excessively nested structures, the compile() function inside markdown.c falls into an uncontrolled deep recursion. This ultimately exhausts the process stack space, causing the application to crash with a DEADLYSIGNAL (Segmentation Fault).
Trigger Condition: The program falls into an excessively deep recursion within the compile() function in markdown.c (line 1445).
./markdown -G crash00.md
Point of Crash: Deep within the recursion stack, compile() invokes the Pp() function (line 1443). Subsequently, Pp() attempts to allocate memory via calloc (line 1214), which triggers a stack-overflow exception caught by AddressSanitizer.
Suggested Mitigation
Introduce a MAX_NESTING_DEPTH constant (e.g., 100 or 200). Add a depth variable to the parsing context structure. Increment this counter before entering a recursive compile() call, and decrement it after returning. If the limit is reached, abort the deep parsing and treat the remaining data as plain text.
crash00.md
This stack exhaustion vulnerability was discovered by SynFuzz.