search

mrragava / onefuzz-notification

0 stars 0 forks source link

setup/fuzz - AddressSanitizer: stack-buffer-overflow /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:33:69 in LLVMFuzzerTestOneInput #2

Open mrragava opened 3 years ago

mrragava commented 3 years ago

Files

Repro

onefuzz --endpoint https://oefuzzingtest2instance.azurewebsites.net repro create_and_connect oft-unique-reports-032590c6e8ea524cb32942a29c898a62 7fdd11a14bfa80c0aee7a2b6eb4a761dd6110a4d08a1b7221cd273b2ff8c7141.json

Call Stack

#1 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
#2 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
#3 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
#4 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
#5 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#6 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9)

ASAN Log

INFO: Loaded 1 modules   (21 inline 8-bit counters): 21 [0x788fb0, 0x788fc5), 
INFO: Loaded 1 PC tables (21 PCs): 21 [0x5664c8,0x566618), 
setup/fuzz: Running 1 inputs 1 time(s) each.
Running: /tmp/.tmpBzkA4F/crash-fc7516b5c665d88cb7c39802367bb25a9c24bb47
=================================================================
==6238==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffffffd03c at pc 0x00000054ae1d bp 0x7fffffffcff0 sp 0x7fffffffcfe8
WRITE of size 4 at 0x7fffffffd03c thread T0
    #0 0x54ae1c in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:33:69
    #1 0x42e9f7 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x42e9f7)
    #2 0x41ee8a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41ee8a)
    #3 0x429e50 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x429e50)
    #4 0x41cb52 in main (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cb52)
    #5 0x7ffff6a99bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #6 0x41cbc9 in _start (/onefuzz/blob-containers/fuzz3rpz7enxyexcq/fuzz+0x41cbc9)

Address 0x7fffffffd03c is located in stack of thread T0 at offset 60 in frame
    #0 0x54a5ff in LLVMFuzzerTestOneInput /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:8

  This frame has 1 object(s):
    [32, 36) 'cnt' (line 9) <== Memory access at offset 60 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /__w/onefuzz-notification/onefuzz-notification/simple-libfuzzer/simple.c:33:69 in LLVMFuzzerTestOneInput
Shadow bytes around the buggy address:
  0x10007fff79b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff79c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff79d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff79e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff79f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10007fff7a00: f1 f1 f1 f1 04 f3 f3[f3]00 00 00 00 00 00 00 00
  0x10007fff7a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10007fff7a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==6238==ABORTING
mrragava commented 3 years ago

Duplicate found.

mrragava commented 3 years ago

Duplicate found.

mrragava commented 3 years ago

Duplicate found.