aha: Buffer overflow in main function at aha.c:973 in aha 0.5.1 allows remote attackers to cause a denial of service (crash) via a crafted input document.

[JieyongMa]

root@fuzz06:/home/fuzz/fuzz/aha-master# gdb --args ./aha -f out/fuzzer1/crashes/poc.txt
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04.1) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./aha...
(gdb) r
Starting program: /home/fuzz/fuzz/aha-master/aha -f out/fuzzer1/crashes/poc.txt

<title>out/fuzzer1/crashes/poc.txt</title>

Program received signal SIGSEGV, Segmentation fault.

0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973

973								momelem=momelem->next;

(gdb) bt

#0  0x000055555555dc2b in main (argc=3, args=0x7fffffffe598) at aha.c:973

(gdb) l

968											state.highlighted = 1;

969											*dest=momelem->value-100;

970										}

971										break;

972								}

973								momelem=momelem->next;

974							}

975							deleteParse(elem);

976						break;

977						case 'H':

(gdb) n
Program terminated with signal SIGSEGV, Segmentation fault.

The program no longer exists.
poc.txt