stcorp / harp

Data harmonization toolset for scientific earth observation data
http://stcorp.github.io/harp/doc/html/index.html
BSD 3-Clause "New" or "Revised" License
55 stars 18 forks source link

harp_program_from_string_fuzzer: #223

Closed schwehr closed 4 years ago

schwehr commented 4 years ago
Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x558d34e521bd in malloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x558d350fdbd0 in harp_sized_array_new libharp/harp-operation-parser.y:99:39
    #2 0x558d350ffd3e in harp_operation_parser_parse libharp/harp-operation-parser.y:413:17
    #3 0x558d35110e55 in harp_program_from_string libharp/harp-operation-parser.y:1700:9
    #4 0x558d34e6b310 in LLVMFuzzerTestOneInput third_party/stcorp_harp/fuzz/harp_program_from_string_fuzzer.cc:19:7

Indirect leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x558d34e524c3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
    #1 0x558d350fe76c in harp_sized_array_add_double libharp/harp-operation-parser.y:172:33
    #2 0x558d350ffdac in harp_operation_parser_parse libharp/harp-operation-parser.y:414:17
    #3 0x558d35110e55 in harp_program_from_string libharp/harp-operation-parser.y:1700:9
    #4 0x558d34e6b310 in LLVMFuzzerTestOneInput third_party/stcorp_harp/fuzz/harp_program_from_string_fuzzer.cc:19:7

SUMMARY: AddressSanitizer: 144 byte(s) leaked in 2 allocation(s).

leak-8823e502e9d1b582dfb9a8d7274804b0da507bef.zip

which is:

regrid(vertical, altitude[mk],(20),(20));

The fuzzer:

#include <stddef.h>
#include <stdint.h>

#include <string>

#include "third_party/absl/cleanup/cleanup.h"
#include "third_party/stcorp_harp/libharp/harp.h"
extern "C" {
#include "third_party/stcorp_harp/libharp/harp-program.h"
}  // extern "C"

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  const std::string operations(reinterpret_cast<const char *>(data), size);

  harp_init();
  auto done = absl::MakeCleanup([] { harp_done(); });

  harp_program *program = nullptr;
  if (harp_program_from_string(operations.c_str(), &program) != 0) {
    return 0;
  }

  // TODO(schwehr): Do something with the program.

  harp_program_delete(program);  // TODO(schwehr): Switch to MakeCleanup.

  return 0;
}
svniemeijer commented 4 years ago

Fixed in 0d8aac8066230bf58852f0fb904d7f87a326a196