Berry-Lang Berry Out-of-Bounds Read Vulnerability in the Lexer

A vulnerability allowing out-of-bounds read has been identified in Berry-Lang Berry versions through 1.1.0. The issue arises in the 'scan_string' function within 'src/be_lexer.c', where the code can read past the intended buffer under certain conditions. This vulnerability requires local access to exploit and has been publicly disclosed, with an available proof-of-concept exploit.

Impact

Exploitation of this vulnerability leads to a global buffer overflow, causing an invalid read access that can be exploited to manipulate the program's execution or cause a crash.

Reproduction

The vulnerability can be reproduced by building Berry with release optimization and AddressSanitizer (ASan) enabled. After compiling the program, it can be run with a crafted script that triggers the out-of-bounds read. This script can be obtained from the GitHub repository 'oneafter/0211'.