CVEs-PoC/2019/CVE-2019-6293.md

CVE-2019-6293

Description

An issue was discovered in the function mark_beginning_as_normal in nfa.c in flex 2.6.4. There is a stack exhaustion problem caused by the mark_beginning_as_normal function making recursive calls to itself in certain scenarios involving lots of '*' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service.

POC

Reference

• https://github.com/westes/flex/issues/414

Github

• https://github.com/ICSE2020-MemLock/MemLock_Benchmark
• https://github.com/SZU-SE/MemLock_Benchmark
• https://github.com/SZU-SE/Stack-overflow-Fuzzer-TestSuite
• https://github.com/fuzz-evaluator/MemLock-Fuzz-eval
• https://github.com/tzf-key/MemLock_Benchmark
• https://github.com/tzf-omkey/MemLock_Benchmark
• https://github.com/wcventure/MemLock-Fuzz
• https://github.com/wcventure/MemLock_Benchmark