search

google / oss-fuzz

OSS-Fuzz - continuous fuzzing for open source software.
https://google.github.io/oss-fuzz
Apache License 2.0
10.48k stars 2.22k forks source link

Null-dereference WRITE with empty stacktrace detected on 0 byte test case in sanitizer_common_interceptors.inc #5857

Open joachimmetz opened 3 years ago

joachimmetz commented 3 years ago

https://oss-fuzz.com/testcase-detail/5050298361053184 detects a "Null-dereference WRITE · NULL"

However looking at the back trace it looks like an issue in the fuzzer (its dependency sanitizer_common_interceptors.inc) not in the fuzz target.

==40592==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000 (pc 0xf7e6f50c bp 0xffa1ddc8 sp 0xffa1d988 T0)
--
 | ==40592==The signal is caused by a WRITE memory access.
 | ==40592==Hint: address points to the zero page.
 | SCARINESS: 10 (null-deref)
 | #0 0xf7e6f50c in libc.so.6
 | #1 0x8120765 in memcpy /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:810:5
 | #2 0x80b74cc in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned int) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:585:3
 | #3 0x80b69f8 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned int, bool, fuzzer::InputInfo*, bool, bool*) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:505:3
 | #4 0x80b850e in fuzzer::Fuzzer::MutateAndTestOne() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:745:19
 | #5 0x80b90b4 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, fuzzer::fuzzer_allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:883:5
 | #6 0x80a83f7 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned int)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:906:6
 | #7 0x80d20d7 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
 | #8 0xf7d63646 in __libc_start_main
 | #9 0x807cfe8 in _start
jonathanmetzman commented 3 years ago

@morehouse What do you think of this?

morehouse commented 3 years ago

It looks like the allocation here is failing and returning null, causing a memcpy(nullptr, ...).

Could the target be hitting some kind of RSS or malloc limit?

joachimmetz commented 3 years ago

the input size of the file (POC) is 0 and this appears to be happening before the actual fuzzing target is invoked

jonathanmetzman commented 3 years ago

Sorry for not realizing what this is earlier. I think this because ASAN is buggy on i386. People have reported this to us before: https://github.com/google/oss-fuzz/issues/2746

I don't have a solution here. I don't think we can invest the resources to fix it. If the bugs are causing too much noise for you, I'd recommend dropping i386 (particularly if you haven't found it is giving you useful i386/32-bit specific bugs.

jonathanmetzman commented 3 years ago

Sorry meant to comment this on #6222.

antonmedv commented 1 year ago

Got similar issue: https://github.com/antonmedv/expr/issues/425


=================================================================
--
  | ==192109==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x000000455372 bp 0x7ffd60e9e900 sp 0x7ffd60e9e8d0 T0)
  | ==192109==The signal is caused by a READ memory access.
  | ==192109==Hint: address points to the zero page.
  | SCARINESS: 10 (null-deref)
  | #0 0x455372 in operator() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp:412:11
  | #1 0x455372 in IterateCounterRegions<(lambda at /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp:411:25)> /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.h:165:9
  | #2 0x455372 in fuzzer::TracePC::ClearInlineCounters() /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.cpp:411:3
  | #3 0x43ddf2 in ResetMaps /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerTracePC.h:87:5
  | #4 0x43ddf2 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:609:9
  | #5 0x43f1b4 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:804:3
  | #6 0x43f689 in fuzzer::Fuzzer::Loop(std::__Fuzzer::vector<fuzzer::SizedFile, std::__Fuzzer::allocator<fuzzer::SizedFile> >&) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:857:3
  | #7 0x42ecef in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:912:6
  | #8 0x458342 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
  | #9 0x7dcc7398e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/libc-start.c:308:16
  | #10 0x41f72d in _start