mirror of
https://github.com/capstone-engine/llvm-capstone.git
synced 2024-11-23 05:40:09 +00:00
[llvm-special-case-list-fuzzer] fix off-by-one read (#73888)
The current fuzzer relies on MemoryBuffer to hold the fuzz data.
However, the fuzzer runs into an OOB instantly because the MemoryBuffer
interface guarantees that "In addition to basic access to the characters
in the file, this interface guarantees you can read one character past
the end of the file, and that this character will read as '\0'."
[ref](https://llvm.org/doxygen/classllvm_1_1MemoryBuffer.html#details),
which the fuzzer fails to satisfy. As such, it runs into an OOB on [this
line](c57ef2c698/llvm/lib/Support/LineIterator.cpp (L48)
).
Consequently, the OSS-Fuzz set up is not running since the build is
declared failing as the fuzzer fails on the first run. See here for
links to build logs
https://introspector.oss-fuzz.com/project-profile?project=llvm and
specifically at the bottom of [this build
log](https://oss-fuzz-build-logs.storage.googleapis.com/log-aecaad16-9581-48fe-af4a-a7be4dd947db.txt).
This change fixes the fuzzer and should solve the OSS-Fuzz build as
well.
Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
parent
9d7b3573ac
commit
7f69c8b3a6
@ -12,8 +12,9 @@
|
||||
#include <cstdlib>
|
||||
|
||||
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
|
||||
std::unique_ptr<llvm::MemoryBuffer> Buf = llvm::MemoryBuffer::getMemBuffer(
|
||||
llvm::StringRef(reinterpret_cast<const char *>(Data), Size), "", false);
|
||||
std::string Payload(reinterpret_cast<const char *>(Data), Size);
|
||||
std::unique_ptr<llvm::MemoryBuffer> Buf =
|
||||
llvm::MemoryBuffer::getMemBuffer(Payload);
|
||||
|
||||
if (!Buf)
|
||||
return 0;
|
||||
|
Loading…
Reference in New Issue
Block a user