Flatcc
Monthly
Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.
Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.
Reachable assertion in the flatcc FlatBuffers schema compiler (versions 0.6.0-0.6.3) crashes the compiler process when a crafted schema file containing duplicate symbol declarations is processed. The `align_order_members` function in `src/compiler/semantics.c` proceeds into member-ordering logic after the parser has already recorded a failure state due to duplicate symbols, violating the function's internal invariant that no duplicates exist and triggering an assertion abort (CWE-617). A proof-of-concept exploit is publicly available via GitHub issue #387, enabling reliable reproduction of the crash with no public exploit code beyond a malformed schema file.
Reachable assertion in the flatcc FlatBuffers compiler (versions 0.6.0-0.6.3) allows remote attackers to crash the compiler process by supplying a crafted schema file containing circular struct references. The `analyze_struct()` function in `semantics.c` proceeds into assertion-protected code paths even after the parser has already flagged a failure state, triggering an abort. No public exploit identified at time of analysis is contradicted by the input: a publicly available proof-of-concept exists on the project's GitHub issue tracker. Impact is limited to denial-of-service of the compiler itself, with no code execution or data exfiltration possible.