From 478597b9f9ae66836759701a9ec708816506d07c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0tetiar?= Date: Mon, 9 Dec 2019 15:27:16 +0100 Subject: blob: fix OOB access in blob_check_type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by fuzzer: ERROR: AddressSanitizer: SEGV on unknown address 0x602100000455 The signal is caused by a READ memory access. #0 in blob_check_type blob.c:214:43 #1 in blob_parse_attr blob.c:234:9 #2 in blob_parse_untrusted blob.c:272:12 #3 in fuzz_blob_parse tests/fuzzer/test-blob-parse-fuzzer.c:34:2 #4 in LLVMFuzzerTestOneInput tests/fuzzer/test-blob-parse-fuzzer.c:39:2 Caused by following line: if (type == BLOB_ATTR_STRING && data[len - 1] != 0) where len was pointing outside of the data buffer. Signed-off-by: Petr Štetiar --- tests/cram/test_blob_parse.t | 2 ++ .../corpus/crash-333757b203a44751d3535f24b05f467183a96d09 | Bin 0 -> 10 bytes 2 files changed, 2 insertions(+) create mode 100644 tests/fuzz/corpus/crash-333757b203a44751d3535f24b05f467183a96d09 (limited to 'tests') diff --git a/tests/cram/test_blob_parse.t b/tests/cram/test_blob_parse.t index 77d8bdd..1fd60bc 100644 --- a/tests/cram/test_blob_parse.t +++ b/tests/cram/test_blob_parse.t @@ -56,6 +56,8 @@ check that blob_parse is producing expected results: cannot parse cert c42ac1c46f1d4e211c735cc7dfad4ff8391110e9 cannot parse cert crash-1b8fb1be45db3aff7699100f497fb74138f3df4f cannot parse cert crash-1b8fb1be45db3aff7699100f497fb74138f3df4f + cannot parse cert crash-333757b203a44751d3535f24b05f467183a96d09 + cannot parse cert crash-333757b203a44751d3535f24b05f467183a96d09 cannot parse cert crash-4c4d2c3c9ade5da9347534e290305c3b9760f627 cannot parse cert crash-4c4d2c3c9ade5da9347534e290305c3b9760f627 cannot parse cert crash-5e9937b197c88bf4e7b7ee2612456cad4cb83f5b diff --git a/tests/fuzz/corpus/crash-333757b203a44751d3535f24b05f467183a96d09 b/tests/fuzz/corpus/crash-333757b203a44751d3535f24b05f467183a96d09 new file mode 100644 index 0000000..b9a958e Binary files /dev/null and b/tests/fuzz/corpus/crash-333757b203a44751d3535f24b05f467183a96d09 differ -- cgit v1.2.3