CVE-2022-43343: Global Buffer overflow in gettoken at Main.c (Ver 1.91) · Issue #75 · sasagawa888/nprolog

Hi @sasagawa888,

I pulled down the most recent version of nprolog (Ver 1.91) and ran it through my fuzz tests. It looks like there is a global buffer overflow in gettoken at Main.c when you tell NPL to run a file in script mode.

I have attached most of the crash files for reproduction. If you compile the project with AddressSanitizer it can also detect the global overflow:

Makefile

CC   = gcc
LIBS = -lm -ldl -fsanitize=address


LIBSRASPI = -lm -ldl -lwiringPi -fsanitize=address
INCS =  
CFLAGS = $(INCS) -Wall -O3 -fsanitize=address
DEST = /usr/local/bin

Running NPL in script mode

crash.zip