mirror of
https://github.com/reactos/syzkaller.git
synced 2025-02-08 12:58:54 +00:00
![Dmitry Vyukov](/assets/img/avatar_default.png)
For string[N] we successfully deserialize a string of any length. Similarly for a fixed-size array[T, N] we successfully deserialize an array of any size. Such programs later crash in foreachSubargOffset because static size Type.Size() does not match what we've calculated iterating over fields. The crash happens only in SerializeForExec in syz-fuzzer, which is especially bad. Fix this from both sides: 1. Validate sizes of arrays/buffers in Validate. 2. Repair incorrect sizes in Deserialize.