From 0f19fa9acd2b4a011fa77b4ba2b695ffb16eb104 Mon Sep 17 00:00:00 2001 From: Catena cyber <35799796+catenacyber@users.noreply.github.com> Date: Thu, 13 Sep 2018 06:22:39 +0200 Subject: [PATCH] Only frees instruction if allocated (#375) * Only frees instruction if allocated * Avoids memory leak in ks_close for EVM --- kstool/kstool.cpp | 6 ++++-- llvm/keystone/ks.cpp | 1 + suite/fuzz/fuzz_asm_arm64_arm.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_arm.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_armbe.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_armv8be.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_thumb.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_thumbbe.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_thumbv8.c | 6 ++++-- suite/fuzz/fuzz_asm_arm_thumbv8be.c | 6 ++++-- suite/fuzz/fuzz_asm_armv8_arm.c | 6 ++++-- suite/fuzz/fuzz_asm_evm.c | 6 ++++-- suite/fuzz/fuzz_asm_hex.c | 6 ++++-- suite/fuzz/fuzz_asm_mips.c | 6 ++++-- suite/fuzz/fuzz_asm_mips64.c | 6 ++++-- suite/fuzz/fuzz_asm_mips64be.c | 6 ++++-- suite/fuzz/fuzz_asm_mipsbe.c | 6 ++++-- suite/fuzz/fuzz_asm_ppc32be.c | 6 ++++-- suite/fuzz/fuzz_asm_ppc64.c | 6 ++++-- suite/fuzz/fuzz_asm_ppc64be.c | 6 ++++-- suite/fuzz/fuzz_asm_sparc.c | 6 ++++-- suite/fuzz/fuzz_asm_sparc64.c | 6 ++++-- suite/fuzz/fuzz_asm_sparc64be.c | 6 ++++-- suite/fuzz/fuzz_asm_sparcbe.c | 6 ++++-- suite/fuzz/fuzz_asm_systemz.c | 6 ++++-- suite/fuzz/fuzz_asm_x86_16.c | 6 ++++-- suite/fuzz/fuzz_asm_x86_32.c | 6 ++++-- suite/fuzz/fuzz_asm_x86_64.c | 6 ++++-- 28 files changed, 109 insertions(+), 54 deletions(-) diff --git a/kstool/kstool.cpp b/kstool/kstool.cpp index 9a96b9de..f6b45e65 100644 --- a/kstool/kstool.cpp +++ b/kstool/kstool.cpp @@ -91,7 +91,7 @@ int main(int argc, char **argv) uint64_t start_addr = 0; char *input = NULL; size_t count; - unsigned char *insn; + unsigned char *insn = NULL; size_t size; if (argc == 2) { @@ -308,7 +308,9 @@ int main(int argc, char **argv) } // NOTE: free insn after usage to avoid leaking memory - ks_free(insn); + if (insn != NULL) { + ks_free(insn); + } // close Keystone instance when done ks_close(ks); diff --git a/llvm/keystone/ks.cpp b/llvm/keystone/ks.cpp index 8f42ed3d..bfb0f6a8 100644 --- a/llvm/keystone/ks.cpp +++ b/llvm/keystone/ks.cpp @@ -501,6 +501,7 @@ ks_err ks_close(ks_engine *ks) if (ks->arch == KS_ARCH_EVM) { // handle EVM differently + delete ks; return KS_ERR_OK; } diff --git a/suite/fuzz/fuzz_asm_arm64_arm.c b/suite/fuzz/fuzz_asm_arm64_arm.c index 4cec7179..b73f7e97 100644 --- a/suite/fuzz/fuzz_asm_arm64_arm.c +++ b/suite/fuzz/fuzz_asm_arm64_arm.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_arm.c b/suite/fuzz/fuzz_asm_arm_arm.c index 113cab3f..0b11b6fa 100644 --- a/suite/fuzz/fuzz_asm_arm_arm.c +++ b/suite/fuzz/fuzz_asm_arm_arm.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_armbe.c b/suite/fuzz/fuzz_asm_arm_armbe.c index 95726f1f..bb485be5 100644 --- a/suite/fuzz/fuzz_asm_arm_armbe.c +++ b/suite/fuzz/fuzz_asm_arm_armbe.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_armv8be.c b/suite/fuzz/fuzz_asm_arm_armv8be.c index 5f9f5b8e..8310c36e 100644 --- a/suite/fuzz/fuzz_asm_arm_armv8be.c +++ b/suite/fuzz/fuzz_asm_arm_armv8be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_thumb.c b/suite/fuzz/fuzz_asm_arm_thumb.c index 89e04e9d..ba4d9c83 100644 --- a/suite/fuzz/fuzz_asm_arm_thumb.c +++ b/suite/fuzz/fuzz_asm_arm_thumb.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_thumbbe.c b/suite/fuzz/fuzz_asm_arm_thumbbe.c index e09c927f..4d53357f 100644 --- a/suite/fuzz/fuzz_asm_arm_thumbbe.c +++ b/suite/fuzz/fuzz_asm_arm_thumbbe.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_thumbv8.c b/suite/fuzz/fuzz_asm_arm_thumbv8.c index 17ba26f2..374d0816 100644 --- a/suite/fuzz/fuzz_asm_arm_thumbv8.c +++ b/suite/fuzz/fuzz_asm_arm_thumbv8.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_arm_thumbv8be.c b/suite/fuzz/fuzz_asm_arm_thumbv8be.c index 3f7f2a1c..5c828ee0 100644 --- a/suite/fuzz/fuzz_asm_arm_thumbv8be.c +++ b/suite/fuzz/fuzz_asm_arm_thumbv8be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_armv8_arm.c b/suite/fuzz/fuzz_asm_armv8_arm.c index a735d8e5..620d0f94 100644 --- a/suite/fuzz/fuzz_asm_armv8_arm.c +++ b/suite/fuzz/fuzz_asm_armv8_arm.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_evm.c b/suite/fuzz/fuzz_asm_evm.c index 5f51e506..7371144c 100644 --- a/suite/fuzz/fuzz_asm_evm.c +++ b/suite/fuzz/fuzz_asm_evm.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_hex.c b/suite/fuzz/fuzz_asm_hex.c index 88408de4..e2c3aa47 100644 --- a/suite/fuzz/fuzz_asm_hex.c +++ b/suite/fuzz/fuzz_asm_hex.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_mips.c b/suite/fuzz/fuzz_asm_mips.c index a7fb2356..e0cd4aab 100644 --- a/suite/fuzz/fuzz_asm_mips.c +++ b/suite/fuzz/fuzz_asm_mips.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_mips64.c b/suite/fuzz/fuzz_asm_mips64.c index 9301eed7..030706d6 100644 --- a/suite/fuzz/fuzz_asm_mips64.c +++ b/suite/fuzz/fuzz_asm_mips64.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_mips64be.c b/suite/fuzz/fuzz_asm_mips64be.c index 1cd81bc9..f05f3947 100644 --- a/suite/fuzz/fuzz_asm_mips64be.c +++ b/suite/fuzz/fuzz_asm_mips64be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_mipsbe.c b/suite/fuzz/fuzz_asm_mipsbe.c index 8e527ab8..307b480f 100644 --- a/suite/fuzz/fuzz_asm_mipsbe.c +++ b/suite/fuzz/fuzz_asm_mipsbe.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_ppc32be.c b/suite/fuzz/fuzz_asm_ppc32be.c index 9e93a30e..e1ff447b 100644 --- a/suite/fuzz/fuzz_asm_ppc32be.c +++ b/suite/fuzz/fuzz_asm_ppc32be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_ppc64.c b/suite/fuzz/fuzz_asm_ppc64.c index 91bec274..0614a44e 100644 --- a/suite/fuzz/fuzz_asm_ppc64.c +++ b/suite/fuzz/fuzz_asm_ppc64.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_ppc64be.c b/suite/fuzz/fuzz_asm_ppc64be.c index dbc33d35..db70e818 100644 --- a/suite/fuzz/fuzz_asm_ppc64be.c +++ b/suite/fuzz/fuzz_asm_ppc64be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_sparc.c b/suite/fuzz/fuzz_asm_sparc.c index dd93a00f..bab8cf15 100644 --- a/suite/fuzz/fuzz_asm_sparc.c +++ b/suite/fuzz/fuzz_asm_sparc.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_sparc64.c b/suite/fuzz/fuzz_asm_sparc64.c index 60842a56..ad424b9c 100644 --- a/suite/fuzz/fuzz_asm_sparc64.c +++ b/suite/fuzz/fuzz_asm_sparc64.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_sparc64be.c b/suite/fuzz/fuzz_asm_sparc64be.c index d7410a23..6e46b370 100644 --- a/suite/fuzz/fuzz_asm_sparc64be.c +++ b/suite/fuzz/fuzz_asm_sparc64be.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_sparcbe.c b/suite/fuzz/fuzz_asm_sparcbe.c index 5125492c..8b8a0c2a 100644 --- a/suite/fuzz/fuzz_asm_sparcbe.c +++ b/suite/fuzz/fuzz_asm_sparcbe.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_systemz.c b/suite/fuzz/fuzz_asm_systemz.c index 24ad70f8..a5e33d35 100644 --- a/suite/fuzz/fuzz_asm_systemz.c +++ b/suite/fuzz/fuzz_asm_systemz.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_x86_16.c b/suite/fuzz/fuzz_asm_x86_16.c index e71cc69b..2b73b965 100644 --- a/suite/fuzz/fuzz_asm_x86_16.c +++ b/suite/fuzz/fuzz_asm_x86_16.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_x86_32.c b/suite/fuzz/fuzz_asm_x86_32.c index e1cf2b4d..f6e92cc1 100644 --- a/suite/fuzz/fuzz_asm_x86_32.c +++ b/suite/fuzz/fuzz_asm_x86_32.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks); diff --git a/suite/fuzz/fuzz_asm_x86_64.c b/suite/fuzz/fuzz_asm_x86_64.c index 30a6b41e..367ac9e2 100644 --- a/suite/fuzz/fuzz_asm_x86_64.c +++ b/suite/fuzz/fuzz_asm_x86_64.c @@ -9,7 +9,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { ks_engine *ks; ks_err err; size_t count; - unsigned char *encode; + unsigned char *encode = NULL; size_t size; char * assembler; @@ -55,7 +55,9 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) { free(assembler); // NOTE: free encode after usage to avoid leaking memory - ks_free(encode); + if (encode != NULL) { + ks_free(encode); + } // close Keystone instance when done ks_close(ks);