Pepper 语言 是一种快速解释型编程语言，旨在追求简洁和清晰。它是动态类型语言，并支持垃圾回收。
创建一个文件，其中一列包含超过 65 个数字。例如，
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
这将导致编译后的 Pepper 语言编译器 pepper 崩溃。以下是使用 AddressSanitizer 时的崩溃结果。
=================================================================
==319391==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x619000000980 at pc 0x5d0c243bf4f5 bp 0x7fff8342bf10 sp 0x7fff8342bf08
WRITE of size 4 at 0x619000000980 thread T0
#0 0x5d0c243bf4f4 in add_constant /home/ch1keen/fuzz/pepper-lang/src/compiler.c:91:50
#1 0x5d0c243bf4f4 in compile_expression /home/ch1keen/fuzz/pepper-lang/src/compiler.c:445:45
#2 0x5d0c243bc551 in compile_statement /home/ch1keen/fuzz/pepper-lang/src/compiler.c:212:19
#3 0x5d0c243bc28d in compile_program /home/ch1keen/fuzz/pepper-lang/src/compiler.c:180:15
#4 0x5d0c243a82dc in run_script /home/ch1keen/fuzz/pepper-lang/src/pepper.c:129:12
#5 0x5d0c243a82dc in main /home/ch1keen/fuzz/pepper-lang/src/pepper.c:161:9
#6 0x768a81e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#7 0x768a81e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#8 0x5d0c242e8434 in _start (/home/ch1keen/fuzz/pepper-lang/bin/pepper+0x29434) (BuildId: b8341ebeb041c31389178ec76172705c296f6f5d)
0x619000000980 is located 0 bytes to the right of 1024-byte region [0x619000000580,0x619000000980)
allocated by thread T0 here:
#0 0x5d0c2436be42 in __interceptor_malloc (/home/ch1keen/fuzz/pepper-lang/bin/pepper+0xace42) (BuildId: b8341ebeb041c31389178ec76172705c296f6f5d)
#1 0x5d0c243c39fb in make_object_list /home/ch1keen/fuzz/pepper-lang/src/object.c:187:37
#2 0x5d0c243b945d in compiler_new /home/ch1keen/fuzz/pepper-lang/src/compiler.c:37:20
#3 0x5d0c243a82ce in run_script /home/ch1keen/fuzz/pepper-lang/src/pepper.c:128:30
#4 0x5d0c243a82ce in main /home/ch1keen/fuzz/pepper-lang/src/pepper.c:161:9
#5 0x768a81e2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#6 0x768a81e2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#7 0x5d0c242e8434 in _start (/home/ch1keen/fuzz/pepper-lang/bin/pepper+0x29434) (BuildId: b8341ebeb041c31389178ec76172705c296f6f5d)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ch1keen/fuzz/pepper-lang/src/compiler.c:91:50 in add_constant
Shadow bytes around the buggy address:
0x0c327fff80e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff80f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff8110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c327fff8120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c327fff8130:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c327fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==319391==ABORTING
编译器结构体中包含 scopes 变量，它是一个固定大小的数组，最多可容纳 64 个 compiler_scope 结构体。
// src/compiler.h
struct compiler {
struct object_list *constants;
struct symbol_table *symbol_table;
uint32_t scope_index;
struct compiler_scope scopes[64];
};
当将概念验证文件传入编译器时，文件首先被词法分析和解析。每个常量被转换为 compiler_scope 类型的变量。但由于 compiler 结构体只能存储 64 个 compiler_scope，文件中超过 65 个 compiler_scope 就会导致堆缓冲区溢出。
注意：由于维护者未能回复安全邮件（详情参见披露时间线），且 Pepper 语言仓库的 issues 面板已关闭，因此无法得到确认。
堆缓冲区溢出不仅允许攻击者修改其他堆对象的内容（例如 Pepper 中其他常量的内容），还能使攻击者让程序执行任意代码。