Closed tregua87 closed 8 months ago
Your code has a bug, where the same value is used in the second and third parameters of gzfread()
, resulting in a request to read data into memory beyond its allocation. Those two parameters being the same buffer size makes no sense, as, just like fread()
, they are multiplied to get the length of the buffer to read into. Your code squares the buffer size and tells gzread()
that that's the size of the buffer at the pointer in the first parameter. In this particular case, gzfread()
is getting a two-byte buffer, and being told to read four bytes into it. If I correct the second parameter of gzfread()
to 1
, then all is well.
There is no issue here in zlib.
Hi. I found an unexpected behavior in
gzfread
while fuzzing zlib with libFuzzer.I prepared a PoC to replicate the crash. I also include building details.
Zlib commit:
09155eaa2f9270dc4ed1fa13e2b4b2613e6e4851
clang:Env: Docker +
ubuntu:20.04
The driver code (
poc.cc
):Build library:
Build driver:
Replicate the crash:
The crash seed: crash.zip