-
Notifications
You must be signed in to change notification settings - Fork 91
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
oss-fuzz-gen: wild-addr-read #303
Comments
On Fri, Jul 26, 2024 at 11:39:18PM -0700, fdt622 wrote:
# Fuzz driver generated by [oss-fuzz-gen](https://github.com/google/oss-fuzz-gen)
```cpp
[...]
Str result = wc_conv_from_utf7(s, ces);
if (result && result->ptr) {
Strfree(result);
}
Strfree(s);
return 0;
}
```
# Wild-addr-read
## Sanitizer output
```
==17==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x55faa67dada3 bp 0x7ffc6d4081d0 sp 0x7ffc6d4081b0 T0)
==17==The signal is caused by a READ memory access.
==17==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
SCARINESS: 20 (wild-addr-read)
#0 0x55faa67dada3 in LLVMFuzzerTestOneInput /src/w3m/libwc/../fuzz/fuzz-conv.c:45:25
What is your line 25?
## Preliminary analysis
```
(gdb) print (void *)result
$2 = (void *) 0x7ffff7e6c620 <result>
```
```
(gdb) x/4xw 0x7ffff7e6c620
0x7ffff7e6c620 <result>: 0x00000000 0x00000000 0x00000000 0x00000000
```
The address 0x7ffff7e6c620 is not NULL. The address of result is
valid, but it may not point to valid data as expected. The memory
contents of result are all zeros, which means that result points to an
invalid memory area or an uninitialized pointer.
result is a struct _Str. It's totally valid to have a struct whose
memory is all zeros. What outcome did you expect?
Also, what is your input? And can you please provide an minimal working
example with such an report? Without being able to reproduce this issue
we will not be able to fix it.
|
Hi, thank you for viewing this issue.
|
On Sat, Jul 27, 2024 at 04:47:47AM -0700, fdt622 wrote:
Hi, thank you for viewing this issue.
Line 45: if (result && result->ptr) {
Input: [crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc](https://drive.google.com/file/d/1TvG0Old2A9OwMAm5Mg_9kZhkzC8s9sWU/view?usp=sharing)
To reproduce this crash, you can simply run
```
fuzz_conv crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
```
When I say reproducible example, I mean something I can compile, change and
debug - not some pre-compiled binary.
Does your code work with other input?
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Fuzz driver generated by oss-fuzz-gen
Wild-addr-read
Sanitizer output
Artifacts
crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
Target binary
fuzz_conv
Preliminary analysis
The address 0x7ffff7e6c620 is not NULL. The address of result is valid, but it may not point to valid data as expected. The memory contents of result are all zeros, which means that result points to an invalid memory area or an uninitialized pointer.
The text was updated successfully, but these errors were encountered: