GHSA-2jx3-ff3v-j7jj

Zip file with crashing_payload: crashing_payload.zip

We have a payload crashing_payload.bin where only a single byte in the structural metadata tail is mutated (changing a SubPatternId from 1 to 248 while keeping the WebAssembly bytecode completely untouched and valid).

Below is the self-contained verification script which compiles and runs against the official unmodified yara-x v1.17.0 crate:

use yara_x::{Rules, Scanner};

fn main() {
    // Embed the crashing payload generated by the fuzzer at compile time.
    let serialized = include_bytes!("crashing_payload.bin");
    println!("Loaded embedded crashing payload, length: {}", serialized.len());

    // Deserialize. On unmodified library, this succeeds because the WASM and headers
    // are pristine and structural corruption isn't validated.
    if let Ok(deserialized) = Rules::deserialize(serialized) {
        println!("Deserialization succeeded! Running scanner...");
        let mut scanner = Scanner::new(&deserialized);
        
        // Run the standard scan, which will execute the WASM and trigger the out-of-bounds read!
        let _ = scanner.scan(b"lorem ipsum dolor sit amet");
        println!("Scanner finished.");
    } else {
        println!("Deserialization failed!");
    }
}

1. Miri Trace

NOTE: This needs to be run with 1.17.0. I haven't tested this against other versions.

Unfortunately I was able to get a miri trace, but I'm not able to reproduce it right now because of lockfile changes. If you're trying this out be sure to use MIRIFLAGS="-Zmiri-disable-stacked-borrows"

2. Segfault / panics

When run natively (without Miri or any sanitizers) on a standard Linux platform, the process immediately segfaults:

$ cargo run --bin verify
Loaded embedded crashing payload, length: 11777
Deserialization succeeded! Running scanner...
Segmentation fault (core dumped)

And with a newer compiler (which appears to have debug assertions in get_unchecked)

Deserialization succeeded! Running scanner...

thread 'main' (997442) panicked at lib/src/compiler/rules.rs:404:36:
unsafe precondition(s) violated: slice::get_unchecked requires that the index is within the slice

This indicates a bug in the program. This Undefined Behavior check is optional, and cannot be relied on for safety.
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

To uphold Rust soundness guarantees, either mark Rules::deserialize as pub unsafe fn deserialize with a formal /// # Safety contract documenting that callers are responsible for verifying the authenticity and structural integrity of the input bytes (e.g. via cryptographic signatures), or replace all internal get_unchecked and to_str_unchecked calls on deserialized data structures with safe bounds checks (.get()) and UTF-8 validation (std::str::from_utf8).