{"action":"opened","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/11070","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/11070/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/11070/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/11070/events","html_url":"https://github.com/systemd/systemd/issues/11070","id":388283402,"node_id":"MDU6SXNzdWUzODgyODM0MDI=","number":11070,"title":"fuzz-bus-message seems to be crashing when strict_string_checks is set to 1","user":{"login":"evverx","id":10195800,"node_id":"MDQ6VXNlcjEwMTk1ODAw","avatar_url":"https://avatars1.githubusercontent.com/u/10195800?v=4","gravatar_id":"","url":"https://api.github.com/users/evverx","html_url":"https://github.com/evverx","followers_url":"https://api.github.com/users/evverx/followers","following_url":"https://api.github.com/users/evverx/following{/other_user}","gists_url":"https://api.github.com/users/evverx/gists{/gist_id}","starred_url":"https://api.github.com/users/evverx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evverx/subscriptions","organizations_url":"https://api.github.com/users/evverx/orgs","repos_url":"https://api.github.com/users/evverx/repos","events_url":"https://api.github.com/users/evverx/events{/privacy}","received_events_url":"https://api.github.com/users/evverx/received_events","type":"User","site_admin":false},"labels":[{"id":191919606,"node_id":"MDU6TGFiZWwxOTE5MTk2MDY=","url":"https://api.github.com/repos/systemd/systemd/labels/bug%20%F0%9F%90%9B","name":"bug 🐛","color":"e11d21","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-06T16:08:46Z","updated_at":"2018-12-06T16:08:46Z","closed_at":null,"author_association":"MEMBER","body":"Now that I can run the fuzzers against the corpora [automatically](https://github.com/google/oss-fuzz/pull/2008), I managed to trigger the following crash by additionally pass `strict_string_checks=1`:\r\n```\r\nRunning: /corpus/./fuzz-bus-message/d547ac75b79a8581c1fe9c04c6e75ed4c5008c82\r\n=================================================================\r\n==60==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0000006da at pc 0x0000004bb5ca bp 0x7ffc47804190 sp 0x7ffc47803940\r\nREAD of size 60 at 0x60b0000006da thread T0\r\nSCARINESS: 26 (multi-byte-read-heap-buffer-overflow)\r\n    #0 0x4bb5c9 in __interceptor___strndup /src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391\r\n    #1 0x7f916b095055 in bus_message_parse_fields /work/build/../../src/systemd/src/libsystemd/sd-bus/bus-message.c:5192:31\r\n    #2 0x7f916b09472c in bus_message_from_malloc /work/build/../../src/systemd/src/libsystemd/sd-bus/bus-message.c:559:13\r\n    #3 0x530c64 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-bus-message.c:32:13\r\n    #4 0x55c315 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15\r\n    #5 0x531b3d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\r\n    #6 0x53d386 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9\r\n    #7 0x5311bc in main /src/libfuzzer/FuzzerMain.cpp:20:10\r\n    #8 0x7f9169d3882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n    #9 0x41d198 in _start (/out/fuzz-bus-message+0x41d198)\r\n\r\n0x60b0000006da is located 0 bytes to the right of 106-byte region [0x60b000000670,0x60b0000006da)\r\nallocated by thread T0 here:\r\n    #0 0x4ebeef in __interceptor_malloc /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:146\r\n    #1 0x7f916af8e103 in memdup /work/build/../../src/systemd/src/basic/alloc-util.c:15:15\r\n    #2 0x530c17 in LLVMFuzzerTestOneInput /work/build/../../src/systemd/src/fuzz/fuzz-bus-message.c:30:9\r\n    #3 0x55c315 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/libfuzzer/FuzzerLoop.cpp:571:15\r\n    #4 0x531b3d in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/libfuzzer/FuzzerDriver.cpp:280:6\r\n    #5 0x53d386 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:713:9\r\n    #6 0x5311bc in main /src/libfuzzer/FuzzerMain.cpp:20:10\r\n    #7 0x7f9169d3882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow /src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:391 in __interceptor___strndup\r\nShadow bytes around the buggy address:\r\n  0x0c167fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff8090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff80a0: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 02\r\n  0x0c167fff80b0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\r\n  0x0c167fff80c0: 00 00 00 00 00 02 fa fa fa fa fa fa fa fa 00 00\r\n=>0x0c167fff80d0: 00 00 00 00 00 00 00 00 00 00 00[02]fa fa fa fa\r\n  0x0c167fff80e0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd\r\n  0x0c167fff80f0: fd fa fa fa fa fa fa fa fa fa fd fd fd fd fd fd\r\n  0x0c167fff8100: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa\r\n  0x0c167fff8110: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa\r\n  0x0c167fff8120: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07\r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n  Shadow gap:              cc\r\n==60==ABORTING\r\n```\r\nI'll add corpus/./fuzz-bus-message/d547ac75b79a8581c1fe9c04c6e75ed4c5008c82 shortly."}}
{"actor":{"display_login":"evverx"}}