Hello,
I found a reproducible memory-safety issue in LCUI's CSS parser.
The issue is reachable from CSS file input and reproduces when parsing a malformed CSS selector. I confirmed it on multiple currently relevant versions:
develop:
commit: 8ffaf66920f715ee8d2b08f40704a1c18e3f1d26
v3.0.0-alpha.0:
commit: 2e0f157f3d5ea5804bd80820466c81c296c70e3b
stable latest v2.2.0:
commit: 85958e44051e60edcb2260f0fb8b1628219a61f0
Under ASan, this reproduces as a heap-buffer-overflow write in the CSS parsing path. In non-ASan builds, I observed process abort / crash behavior as well.
I have a minimized reproducer, ASan/plain logs, build and reproduction scripts, source notes, and a suggested hardening direction. Since this is a memory-safety issue and may have security impact depending on how applications load CSS resources, I would prefer to share the full details privately first.
Could you please let me know the preferred way to report a security issue for this project, or whether you can enable GitHub Private Vulnerability Reporting / create a draft GitHub Security Advisory for coordination?
Thank you.
Hello,
I found a reproducible memory-safety issue in LCUI's CSS parser.
The issue is reachable from CSS file input and reproduces when parsing a malformed CSS selector. I confirmed it on multiple currently relevant versions:
Under ASan, this reproduces as a heap-buffer-overflow write in the CSS parsing path. In non-ASan builds, I observed process abort / crash behavior as well.
I have a minimized reproducer, ASan/plain logs, build and reproduction scripts, source notes, and a suggested hardening direction. Since this is a memory-safety issue and may have security impact depending on how applications load CSS resources, I would prefer to share the full details privately first.
Could you please let me know the preferred way to report a security issue for this project, or whether you can enable GitHub Private Vulnerability Reporting / create a draft GitHub Security Advisory for coordination?
Thank you.