Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NULL dereference in BuildAbsolutePath #331

Closed
anfedotoff opened this issue Aug 11, 2022 · 1 comment
Closed

NULL dereference in BuildAbsolutePath #331

anfedotoff opened this issue Aug 11, 2022 · 1 comment

Comments

@anfedotoff
Copy link

Hi!
While fuzzing I could trigger this such case:

Starting program: /lcms_sydr/cmsIT8_load_sydr /fuzz/crash-0485db99e2b54857ef08923bcf3b1252afe03603

#0  __strncpy_avx2 () at ../sysdeps/x86_64/multiarch/strcpy-avx2.S:363
#1  0x0000000000219b19 in strncpy (__len=255, __src=0x4ae8d0 "", __dest=0x0) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:106
#2  BuildAbsolutePath (MaxLen=255, buffer=0x0, basePath=0x4ae8d0 "", relPath=0x4aee08 "") at cmscgats.c:492
#3  InSymbol (it8=it8@entry=0x46c350) at cmscgats.c:1002
#4  0x000000000021b470 in DataFormatSection (it8=0x46c350) at cmscgats.c:1965
#5  ParseIT8 (it8=it8@entry=0x46c350, nosheet=nosheet@entry=0) at cmscgats.c:2202
#6  0x000000000021bc12 in cmsIT8LoadFromMem (ContextID=0x0, Ptr=0x46c0c0, len=644) at cmscgats.c:2443
#7  0x0000000000217eea in LLVMFuzzerTestOneInput (
    data=0x46c0c0 "an:\n\tan:\n\t=rm 4esvs\tl;q\r\r\r\r\r\r\rCCAaW:\n\tan:\n\t=rm 4esvs\rl;q", '\r' <repeats 20 times>, "sucms.o ../src/li\n\t-rs\n\nins", '\032' <repeats 21 times>, "*\032\032\032\032\032\n\ninstal\\:\n BMME\"\r\nNUMBER_OF_FIELDS\t0666666566c/li\n\t-rs\n\nins\032\032\032\032\032\032\032\066ER"..., size=644) at ./cmsIT8_load_sydr.c:28
#8  0x0000000000217fcf in main (argc=2, argv=0x7fffffffe668) at ./cmsIT8_load_sydr.c:45

It's known problem, I think.
I attach crash-0485db99e2b54857ef08923bcf3b1252afe03603.txt.
If you interested how to reproduce, please look here.

@anfedotoff
Copy link
Author

Fixed by this commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant