Null pointer dereference in latest bison (intersect_symbol src/lssi.c:276)

--00000000000035c52905f920f0c7
Content-Type: text/plain; charset="UTF-8"

Hello, our fuzzer found a new SERV bug in bison,

*Command*
bison poc_file --report=c
(poc_file is attached)

*Output (stderr)*
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:25.22:
warning: symbol 'J' is used, but is not defined as a token and has no rules
[-Wother]
   25 | %type  <Integer> exp J%nonassoc '='       /* comparison
      |                      ^
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:53.27:
warning: stray '$' [-Wother]
   53 |     if ($1.intValue () != $intValue ())
      |                           ^
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:
warning: 1 nonterminal useless in grammar [-Wother]
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:25.22:
warning: nonterminal useless in grammar: J [-Wother]
   25 | %type  <Integer> exp J%nonassoc '='       /* comparison
      |                      ^
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:
warning: 1 shift/reduce conflict [-Wconflicts-sr]
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:
warning: 12 reduce/reduce conflicts [-Wconflicts-rr]
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:
note: rerun with option '-Wcounterexamples' to generate conflict
counterexamples
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:34.3-7:
warning: rule useless in parser due to conflicts [-Wother]
   34 | | input line:
      |   ^~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:50.3-77:
warning: rule useless in parser due to conflicts [-Wother]
   50 |   NUM                { $$ = $1;
        }
      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:51.3-79.70:
warning: rule useless in parser due to conflicts [-Wother]
   51 | | exp '=' exp
      |   ^~~~~~~~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:81.3-83.85:
warning: rule useless in parser due to conflicts [-Wother]
   81 |   {
      |   ^
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:88.3-35:
warning: rule useless in parser due to conflicts [-Wother]
   88 |   NUM                { $$ = $1;   }
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:89.3-91.23:
warning: rule useless in parser due to conflicts [-Wother]
   89 | | exp '=' exp
      |   ^~~~~~~~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:93.3-95.52:
warning: rule useless in parser due to conflicts [-Wother]
   93 |   {
      |   ^
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:100.3-77:
warning: rule useless in parser due to conflicts [-Wother]
  100 |   NUM                { $$ = $1;
        }
      |
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/youngseok/data/230411/asan_inter_30_30_shrink5_1_230308/bison/3_id:000275/poc_file:101.3-127.1:
warning: rule useless in parser due to conflicts [-Wother]
  101 | | exp '=' exp
      |   ^~~~~~~~~~~

*Sanitizer Dump*
==7175==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc
0x5555555d0b7a bp 0x7fffffffb3a0 sp 0x7fffffff9300 T0)
==7175==The signal is caused by a READ memory access.
==7175==Hint: address points to the zero page.
    #0 0x5555555d0b79 in intersect_symbol src/lssi.c:276
    #1 0x5555555a1650 in reduction_step src/counterexample.c:831
    #2 0x5555555a3487 in generate_next_states src/counterexample.c:1047
    #3 0x5555555a43f5 in unifying_example src/counterexample.c:1182
    #4 0x5555555a4fac in counterexample_report src/counterexample.c:1283
    #5 0x5555555a600d in counterexample_report_reduce_reduce
src/counterexample.c:1356
    #6 0x5555555a6a0b in counterexample_report_state
src/counterexample.c:1400
    #7 0x5555556161c1 in print_state src/print.c:366
    #8 0x555555617041 in print_results src/print.c:471
    #9 0x5555555d225d in main src/main.c:188
    #10 0x7ffff6a48c86 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21c86)
    #11 0x555555588b49 in _start
(/home/youngseok/subjects/latest_asan_install/bison/bin/bison+0x34b49)

*Environment*
OS: Ubuntu 18.04
gcc: 7.5.0
Bison: 3.8.2.46-9785 (git commit 97852f39f42a28abfcaf1c46b1f06920eae151c9)

We used address sanitizer to reason the crash. Here is the build script:
CFLAGS="-fsanitize=address -g -O0" ./configure

Thank you
Youngseok Choi

--00000000000035c52905f920f0c7
Content-Type: application/octet-stream; name=poc_file
Content-Disposition: attachment; filename=poc_file
Content-Transfer-Encoding: base64
Content-ID: <f_lgdjgi8x0>
X-Attachment-Id: f_lgdjgi8x0

JWxhbmd1YWdlICJKYXZhIgoKJWRlZmluZSBhc2UuZXJyb3IgdmVyYm9zZQolbG9jYXRpb25zCgol
Y29kZSBpbXBvcnRzIHsKLSBpAGRvcnQgamF2YS5pby5JT0V4Y2VwdGlvbjsKICBpbXBvcnQgamEA
AQAAby5JbnB1dFN0cmVhbTsKICBpbXBvcnQgamF2YS5pby5JbnB1dFN0cmVhbVJlYWRlcjsKICBp
bXBvcnQgamF2YS5pby5SZWFkZXI7CiAgaW1wb3J0IGphdmEuaW8uU3RyZWFtVG9rZW5pemVyOwp9
CgolY29kZSB7CiAgcHVibGljIHN0YXRpYyB2b2lkIG1haW4gKFN0cmluZyBhcmdXW10pIHRocm93
cyBJT0V4Y2VwdGlvbgogIHsKICAgIENhbGNMZXhlciBsID0gbmV3IENhbGNMZXhlciAoU3lzdGVt
LmluKTsKICAgIENhbGMgcCA9IG5ldyBDYWxjIChsKTsKICAgIHAucGFyc2UgKCk7CiAgfQp9Cgov
KiBCaXNvbiBEZWNsYXJhdGlvbnMgKi8KJXRva2VuIDxJbnRlZ2VyPiBOVU0gIm51bWJlciIKJXR5
cGUgIDxJbnRlZ2VyPiBleHAgSiVub25hc3NvYyAnPScgICAgICAgLyogY29tcGFyaXNvbiAgICAK
ICAnXG4nCnwgZXhwICdcbicgICAgICAgICAgIHsgU3lzdGVtLm91cHJlY2VkZW5jZSBORUcgICAg
IC8qIG5lZ2F0aW9uLS11bmFyeSBtaW51cyAqLwolcmlnaHQgJzwnICAgICAgICAgIC8qIGV4cG9u
ZW50aWF0aW9uICAgICAgICAqLwoKLyogR3JhbW1hciBmb////wFzICovCiUlCmlucHV0OgogIGxp
bmUKfCBpbnB1dCBsaW5lOgogICdcbicKfCBleHAgJ1xuJyAgICAgICAgICAgeyBTeXN0ZW0ub3V0
LnByaW50bG4gKCRleHApOyB9CiBlcnJvciAnXG4nCjsKCmV4cDoKICBOVU0gICAgICAgICAgICAg
ICAgeyAkJCA9ICQxOyAgICAgICAgICogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgfQp8IGV4cCAnPScgZXhwCiAgewogICAgaWYgKCQxLmludFZhbHVlICgpICE9ICQz
LmludFZhbHVlICgpKQogICAgICB5eWVycm9yIChAJCwgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICBNJDEuaW50VmFsdWUgKCkgKyAkMy5pbnRWYWx1ZSAoKSk7ICB9CiAnXG4nCjsKCmV4cDoK
ICBOVU0gICAgICAgICAgICAgICAgeyAkJCA9ICQxOyAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIH0KfCBleHAgJz0nIGV4cAogIHsKICAgIGlmICgkMS5pbnRWYWx1
ZSAoKSAhPSAkzC5pbnRWYWx1ZSAoKSkKICAgICAgeXllYHJvciAoQCQsICJjYWxjOiBlcnJvcjog
IiArIHwgZXhwICcQJyBleHAgICAgICAgIHsgJCQgPSBuZXcgSW50ZWdlciAoJDEuaW50VmFsdWUg
KCkgLyAkMy5pbnRWYWx1ZSAoKSk7ICB9CnwgJy0nIGV4cCAgJXByZWMgTkVHIHsgJCQgPSBuZXcg
SW50ZWdlciAoAAAAAAAAABBhbHVlICgpKTsgICkgKiAkMy5pbnRWYWx1ZSB9CnwgZXhwICdeJyBl
eHAgICAgICAgIHsgJCQgPSBuZXcgSW50ZWdlciAoKGludCkKICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICBNYXRoLnBvdyAoJDEuaW50VmFsdWUgKCksCiAgICAgICAgICAg
IPoAACRleHApOyB9CnwgZXJyb3IgJ1xuJwo7CgpleHA6CiAgTlVNICAgICAgICAgICAgICAgIHsg
JCQgPSAkMTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB9Cnwg
ZXhwICc9JyBleHAKICB7CiAgICBpZiAoJDEuaW50VmFsdWUgKCkgIT0gJDMuaW50VmFsdWUgKCkp
CiAgICAgIHl5ZWByb3IgKEAkLCAiY2FsYzogZXJyb3I6ICIgKyAkMSArICIgIT0gIiArICQzKTsK
ICB9CnwgZXhwICcrJyBleHAgICAgICAgIHsgJCQgPSBuZXcgSW50ZWdlciAoJDFldy5pbnRWYWx1
ZSAoKSArICQzLmludFZhbHVlICgpKTsgIH0KfCBleHAgJy0nIGV4ICctJyBlcnJvciAgICAgICAg
ICB7ICQkID0gbmV3IEludGVnZXIgKDApOyByZXR1cm4gWVlFUlJPUjsgICAgICAgICAgICAgICAg
fQo7CgoKJSUKY2xhc3MgQ2FsY0xleGVyIGltcGxlbWVudHMgQ2FsYy5MZXhlciB7CgogIFN0cmVh
bVRva2VuaXplciAKICBwdWJsaWMgYm9vbGVhbiBlcXVhbHMgKFBvc2l0aW9uIGwucHJpbnRsbiAo
JGV4cCk7IH0KfCBlcnJvciAkJCA9ICQxOyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgfQp8IGV4cCAnPScgZXhwCiAgewogICAgaWYgKCQxLmludFZh
bHVlICgpICE9ICQzLmludFZhbHVlICgpKQogICAgICB5eWVycm9yIChAJCwgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICBNJDEuaW50VmFsdWUgKCkgKyAkMy5pbnRWYWx1ZSAoKSk7ICB9CiAn
XG4nCjsKCmV4cDoKICBOVU0gICAgICAgICAgICAgICAgeyAkJCA9ICQxOyAgIH0KfCBleHAgJz0n
IGV4cAogIHsKICAgIGlmICAgICAgICAgICAgICAgIH0KfCBleHAgJz0nIGV4cAogIHsKICAgIGlm
ICgkMS5pbnRWYWx1ZSAoKSAhPSAkMy5pbnRWYWx1ZSAoKSkKICAgICAgeXllYHJvciAoQCQsICJj
YWxjOiBlcnJvcjogIiArIHwgZXhwdWUgKCkpOyAgfQogJ1xuJwo7CgpleHA6CiAgTlVNICAgICAg
ICAgICAgICAgIHsgJCQgPSAkMTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICB9CnwgZXhwICc9JyBleHAKICB7CiAgICBpZiAoJDEuaW50VmFsdWUgKCkgIT0gJDMu
aW50VmFsdWUgKCkpCiAgICAgIHl5ZWByb3IgKEAkLCAiY2FsYzogZXJyb3I6ICIgKyB8IGV4cCAn
LycgZXhwICAgICAgICB7ICQkID0gbmV3IEludGVnZXIgKCQxLmludFZhbHVlICgpIC8gJDMuaW50
VmFsdWUgKCkpOyAgfQp8ICctJyBleHAgICVwcmVjIE5FRyB7ICQkID0gbmV3IEludGVnZXIgKAAA
AAAAAAAQYWx1ZSAoKSk7ICApICogJDMuaW50VmFsdWUgfQp8IGV4cCAnXicgZXhwJ1xuJwo7Cgpl
eHA6CiAgTlVNICAgICAgICAgICAgICkKICB7CiAgICByZXR1cm4gbC5saW5lID09IGxpbmUgJiYg
bC50b2tlbiA9PSB0b2tlbjsKICB9CgogIHB1YmxpYyBTdHJpbmcgdG9TdHJpbmcgKCkKICB7CiAg
ICByZXR1cm4gSW50ZWdlci50b1N0cmluZyAobGluZSkgKyAiLiIgKyBJbnRlZ2VyLnRvU3RyaW5n
KHRva2VuKTsKICB9AH8gIHB1YmxpYyBpbnQgbFxuZW5vICgpCiAgewogICAgcmV0dXJuIGxpbmU7
CiAgfQoKICBwdWJsaWMgaW50IHRva2VuICgpCiAgewogICAgcmV0dXJuIHRva2VuOwogIH0KfQo=
--00000000000035c52905f920f0c7--