Skip to content
This repository has been archived by the owner on Jun 4, 2021. It is now read-only.

Heap Buffer Overflow while decoding (use s16) (detected by LibFuzzer) #1

Open
eeeeYxN opened this issue Oct 8, 2018 · 0 comments
Open

Comments

@eeeeYxN
Copy link

eeeeYxN commented Oct 8, 2018

Here is my LLVMFuzzerTestOneInput : (change suffix .txt to .c)
testInput.txt

sizeof in is : 79
0 : 255
1 : 192
2 : 255
3 : 255
4 : 255
5 : 255
6 : 255
7 : 255
8 : 255
9 : 255
10 : 255
11 : 255
12 : 255
13 : 255
14 : 255
15 : 255
16 : 255
17 : 255
18 : 255
19 : 255
20 : 255
21 : 255
22 : 255
23 : 255
24 : 255
25 : 255
26 : 255
27 : 255
28 : 255
29 : 255
30 : 255
31 : 255
32 : 255
33 : 255
34 : 255
35 : 255
36 : 255
37 : 255
38 : 255
39 : 255
40 : 255
41 : 255
42 : 255
43 : 255
44 : 255
45 : 255
46 : 255
47 : 255
48 : 255
49 : 255
50 : 255
51 : 255
52 : 255
53 : 255
54 : 255
55 : 255
56 : 255
57 : 255
58 : 255
59 : 255
60 : 255
61 : 255
62 : 255
63 : 255
64 : 255
65 : 255
66 : 255
67 : 255
68 : 255
69 : 255
70 : 255
71 : 255
72 : 255
73 : 255
74 : 255
75 : 255
76 : 255
77 : 255
78 : 10

=================================================================
==2834==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6120000011fc at pc 0x0000005506b9 bp 0x7fff38558240 sp 0x7fff38558238
WRITE of size 4 at 0x6120000011fc thread T0
#0 0x5506b8 (/my/compression/testInput+0x5506b8)
#1 0x54b66a (/my/compression/testInput+0x54b66a)
#2 0x54aa71 (/my/compression/testInput+0x54aa71)
#3 0x42ea87 (/my/compression/testInput+0x42ea87)
#4 0x4392f4 (/my/compression/testInput+0x4392f4)
#5 0x43a95f (/my/compression/testInput+0x43a95f)
#6 0x429d1c (/my/compression/testInput+0x429d1c)
#7 0x41cbe2 (/my/compression/testInput+0x41cbe2)
#8 0x7f96a7fa5b96 (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
#9 0x41cc59 (/my/compression/testInput+0x41cc59)

0x6120000011fc is located 0 bytes to the right of 316-byte region [0x6120000010c0,0x6120000011fc)
allocated by thread T0 here:
#0 0x512170 (/my/compression/testInput+0x512170)
#1 0x54a98d (/my/compression/testInput+0x54a98d)
#2 0x42ea87 (/my/compression/testInput+0x42ea87)
#3 0x4392f4 (/my/compression/testInput+0x4392f4)
#4 0x43a95f (/my/compression/testInput+0x43a95f)
#5 0x429d1c (/my/compression/testInput+0x429d1c)
#6 0x41cbe2 (/my/compression/testInput+0x41cbe2)
#7 0x7f96a7fa5b96 (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/my/compression/testInput+0x5506b8)
Shadow bytes around the buggy address:
0x0c247fff81e0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
0x0c247fff8210: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[04]
0x0c247fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==2834==ABORTING

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant