{"action":"opened","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/13021","repository_url":"https://api.github.com/repos/radare/radare2","labels_url":"https://api.github.com/repos/radare/radare2/issues/13021/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/13021/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/13021/events","html_url":"https://github.com/radare/radare2/issues/13021","id":408119030,"node_id":"MDU6SXNzdWU0MDgxMTkwMzA=","number":13021,"title":"bin from clusterfuzz","user":{"login":"radare","id":917142,"node_id":"MDQ6VXNlcjkxNzE0Mg==","avatar_url":"https://avatars1.githubusercontent.com/u/917142?v=4","gravatar_id":"","url":"https://api.github.com/users/radare","html_url":"https://github.com/radare","followers_url":"https://api.github.com/users/radare/followers","following_url":"https://api.github.com/users/radare/following{/other_user}","gists_url":"https://api.github.com/users/radare/gists{/gist_id}","starred_url":"https://api.github.com/users/radare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/radare/subscriptions","organizations_url":"https://api.github.com/users/radare/orgs","repos_url":"https://api.github.com/users/radare/repos","events_url":"https://api.github.com/users/radare/events{/privacy}","received_events_url":"https://api.github.com/users/radare/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-02-08T11:48:42Z","updated_at":"2019-02-08T11:48:42Z","closed_at":null,"author_association":"OWNER","body":"[clusterfuzz-testcase-minimized-ia_fuzz-5643065568526336.dms.zip](https://github.com/radare/radare2/files/2844948/clusterfuzz-testcase-minimized-ia_fuzz-5643065568526336.dms.zip)\r\n\r\n\r\n```\r\n$ r2 clusterfuzz-testcase-minimized-ia_fuzz-5643065568526336.dms \r\n=================================================================\r\n==73844==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62600007dfd5 at pc 0x000103a3962f bp 0x7ffeed856dd0 sp 0x7ffeed856dc8\r\nREAD of size 1 at 0x62600007dfd5 thread T0\r\n    #0 0x103a3962e in dex_parse_debug_item bin_dex.c:603\r\n    #1 0x103a30eca in parse_dex_class_method bin_dex.c:1363\r\n    #2 0x103a23718 in parse_class bin_dex.c:1562\r\n    #3 0x103a1c37d in dex_loadcode bin_dex.c:1661\r\n    #4 0x103a090f5 in entries bin_dex.c:1799\r\n    #5 0x103941013 in r_bin_object_set_items obj.c:338\r\n    #6 0x10393edbb in r_bin_object_new obj.c:239\r\n    #7 0x103927aae in r_bin_file_new_from_bytes bfile.c:469\r\n    #8 0x1038d03ed in r_bin_open_io bin.c:407\r\n    #9 0x102877da2 in r_core_file_do_load_for_io_plugin cfile.c:380\r\n    #10 0x10286cf24 in r_core_bin_load cfile.c:538\r\n    #11 0x1023a9a0c in main (r2:x86_64+0x100008a0c)\r\n    #12 0x7fff73f5bed8 in start (libdyld.dylib:x86_64+0x16ed8)\r\n\r\n0x62600007dfd5 is located 0 bytes to the right of 11989-byte region [0x62600007b100,0x62600007dfd5)\r\nallocated by thread T0 here:\r\n    #0 0x10cad2497 in wrap_calloc (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x57497)\r\n    #1 0x1038cde1d in r_bin_open_io bin.c:364\r\n    #2 0x102877da2 in r_core_file_do_load_for_io_plugin cfile.c:380\r\n    #3 0x10286cf24 in r_core_bin_load cfile.c:538\r\n    #4 0x1023a9a0c in main (r2:x86_64+0x100008a0c)\r\n    #5 0x7fff73f5bed8 in start (libdyld.dylib:x86_64+0x16ed8)\r\n\r\nSUMMARY: AddressSanitizer: heap-buffer-overflow bin_dex.c:603 in dex_parse_debug_item\r\nShadow bytes around the buggy address:\r\n  0x1c4c0000fba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fbb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fbc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fbd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fbe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n=>0x1c4c0000fbf0: 00 00 00 00 00 00 00 00 00 00[05]fa fa fa fa fa\r\n  0x1c4c0000fc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x1c4c0000fc10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\r\n  0x1c4c0000fc20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fc30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n  0x1c4c0000fc40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\nShadow byte legend (one shadow byte represents 8 application bytes):\r\n  Addressable:           00\r\n  Partially addressable: 01 02 03 04 05 06 07 \r\n  Heap left redzone:       fa\r\n  Freed heap region:       fd\r\n  Stack left redzone:      f1\r\n  Stack mid redzone:       f2\r\n  Stack right redzone:     f3\r\n  Stack after return:      f5\r\n  Stack use after scope:   f8\r\n  Global redzone:          f9\r\n  Global init order:       f6\r\n  Poisoned by user:        f7\r\n  Container overflow:      fc\r\n  Array cookie:            ac\r\n  Intra object redzone:    bb\r\n  ASan internal:           fe\r\n  Left alloca redzone:     ca\r\n  Right alloca redzone:    cb\r\n==73844==ABORTING\r\nAbort trap: 6\r\n\r\n```\r\n"}}
{"actor":{"display_login":"radare"}}