[llvm-special-case-list-fuzzer] fix off-by-one read (#73888)

The current fuzzer relies on MemoryBuffer to hold the fuzz data.
However, the fuzzer runs into an OOB instantly because the MemoryBuffer
interface guarantees that "In addition to basic access to the characters
in the file, this interface guarantees you can read one character past
the end of the file, and that this character will read as '\0'."
[ref](https://llvm.org/doxygen/classllvm_1_1MemoryBuffer.html#details),
which the fuzzer fails to satisfy. As such, it runs into an OOB on [this
line](c57ef2c698/llvm/lib/Support/LineIterator.cpp (L48)).

Consequently, the OSS-Fuzz set up is not running since the build is
declared failing as the fuzzer fails on the first run. See here for
links to build logs
https://introspector.oss-fuzz.com/project-profile?project=llvm and
specifically at the bottom of [this build
log](https://oss-fuzz-build-logs.storage.googleapis.com/log-aecaad16-9581-48fe-af4a-a7be4dd947db.txt).

This change fixes the fuzzer and should solve the OSS-Fuzz build as
well.

Signed-off-by: David Korczynski <david@adalogics.com>
This commit is contained in:
DavidKorczynski 2023-12-28 17:04:25 +00:00 committed by GitHub
parent 9d7b3573ac
commit 7f69c8b3a6
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -12,8 +12,9 @@
#include <cstdlib>
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
std::unique_ptr<llvm::MemoryBuffer> Buf = llvm::MemoryBuffer::getMemBuffer(
llvm::StringRef(reinterpret_cast<const char *>(Data), Size), "", false);
std::string Payload(reinterpret_cast<const char *>(Data), Size);
std::unique_ptr<llvm::MemoryBuffer> Buf =
llvm::MemoryBuffer::getMemBuffer(Payload);
if (!Buf)
return 0;