Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crash found by AFL #32

Closed
frewsxcv opened this issue Oct 25, 2015 · 0 comments
Closed

Crash found by AFL #32

frewsxcv opened this issue Oct 25, 2015 · 0 comments

Comments

@frewsxcv
Copy link

test case

    #[test]
    fn test_fuzz() {
        assert_deserializes(vec![
            (Err(DeserializationError::InvalidValue), b"\x30\x86\xcd\x98\x81\xcd\xcd\x0a\xcd\x0a".to_vec())
        ], |deserializer| {
            return deserializer.read_sequence(|d| {
                Ok((try!(d.read_int::<i64>()),
                    try!(d.read_octet_string()),
                    try!(d.read_object_identifier()),
                    try!(d.read_bool())))
            });
        });
    }

run test

coreyf@frewbook-pro ~/D/r/rust-asn1 (master) [101]> cargo test test_fuzz
     Running target/debug/asn1-7ff997e9ea245d04

running 1 test
Process didn't exit successfully: `/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04 test_fuzz` (signal: 4)

lldb backtrace

coreyf@frewbook-pro ~/D/r/rust-asn1 (master) [127]>
lldb /Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04 test_fuzz
(lldb) target create "/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04"
Current executable set to '/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04' (x86_64).
(lldb) settings set -- target.run-args  "test_fuzz"
(lldb) run
Process 78929 launched: '/Users/coreyf/Development/rust/rust-asn1/target/debug/asn1-7ff997e9ea245d04' (x86_64)

running 1 test
Process 78929 stopped
* thread #2: tid = 0x264423, 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4, name = 'deserializer::tests::test_fuzz', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
    frame #0: 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4
asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub:
->  0x1000ac004 <+4>: ud2
    0x1000ac006 <+6>: nopw   %cs:(%rax,%rax)

asn1-7ff997e9ea245d04`__rust_allocate:
    0x1000ac010 <+0>: pushq  %rbp
    0x1000ac011 <+1>: movq   %rsp, %rbp
(lldb) bt
* thread #2: tid = 0x264423, 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4, name = 'deserializer::tests::test_fuzz', stop reason = EXC_BAD_INSTRUCTION (code=EXC_I386_INVOP, subcode=0x0)
  * frame #0: 0x00000001000ac004 asn1-7ff997e9ea245d04`oom::h60a2387de2f8f1f2fub + 4
    frame #1: 0x0000000100004abc asn1-7ff997e9ea245d04`asn1::raw_vec::RawVec<T>::with_capacity(cap=226054896471306) + 156 at raw_vec.rs:103
    frame #2: 0x0000000100004a00 asn1-7ff997e9ea245d04`asn1::vec::Vec<T>::with_capacity(capacity=226054896471306) + 32 at vec.rs:282
    frame #3: 0x0000000100004950 asn1-7ff997e9ea245d04`asn1::vec::from_elem<u8>(elem='\0', n=226054896471306) + 48 at vec.rs:1058
    frame #4: 0x000000010002863f asn1-7ff997e9ea245d04`asn1::deserializer::Deserializer::_read_with_tag<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool),closure>(self=0x0000700000403828, expected_tag='0', body=(__0 = 0x0000700000403590)) + 703 at deserializer.rs:92
    frame #5: 0x000000010002834d asn1-7ff997e9ea245d04`asn1::deserializer::Deserializer::read_sequence<closure,(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool)>(self=0x0000700000403828, v=closure @ 0x0000700000403590) + 77 at deserializer.rs:164
    frame #6: 0x0000000100027760 asn1-7ff997e9ea245d04`fnfn(deserializer=0x0000700000403828) + 64 at deserializer.rs:378
    frame #7: 0x0000000100027707 asn1-7ff997e9ea245d04`asn1::ops::impls::&'a F.Fn<A>::call(self=0x0000700000403848, args=(&mut asn1::deserializer::Deserializer) @ 0x0000700000403690) + 39 at ops.rs:1760
    frame #8: 0x000000010002735b asn1-7ff997e9ea245d04`asn1::deserializer::from_vec<&closure,(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool)>(data=Vec<u8> @ 0x0000700000403850, f=0x0000700000403ae0) + 171 at deserializer.rs:173
    frame #9: 0x0000000100025f3c asn1-7ff997e9ea245d04`asn1::deserializer::tests::assert_deserializes<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool),closure>(values=Vec<(core::result::Result<(i64, collections::vec::Vec<u8>, asn1::utils::ObjectIdentifier, bool), asn1::deserializer::DeserializationError>, collections::vec::Vec<u8>)> @ 0x0000700000403ae8, f=closure @ 0x0000700000403ae0) + 492 at deserializer.rs:191
    frame #10: 0x0000000100025cfb asn1-7ff997e9ea245d04`asn1::deserializer::tests::test_fuzz + 347 at deserializer.rs:375
    frame #11: 0x000000010008226c asn1-7ff997e9ea245d04`boxed::_$LT$impl$GT$::call_box::call_box::h13072048137075833162 + 28
    frame #12: 0x0000000100084971 asn1-7ff997e9ea245d04`sys_common::unwind::try::try_fn::try_fn::h751026771818371460 + 433
    frame #13: 0x00000001000a7929 asn1-7ff997e9ea245d04`__rust_try + 9
    frame #14: 0x00000001000a58cf asn1-7ff997e9ea245d04`sys_common::unwind::try::inner_try::h2088a2c04cd75530O7r + 111
    frame #15: 0x0000000100084d6b asn1-7ff997e9ea245d04`boxed::_$LT$impl$GT$::call_box::call_box::h9872188538580151393 + 411
    frame #16: 0x00000001000a92fe asn1-7ff997e9ea245d04`sys::thread::_$LT$impl$GT$::new::thread_start::h72c909587b43bc6f8tw + 142
    frame #17: 0x00007fff94c049b1 libsystem_pthread.dylib`_pthread_body + 131
    frame #18: 0x00007fff94c0492e libsystem_pthread.dylib`_pthread_start + 168
    frame #19: 0x00007fff94c02385 libsystem_pthread.dylib`thread_start + 13
@alex alex closed this as completed in f3a98a0 Oct 25, 2015
alex added a commit that referenced this issue Oct 25, 2015
fixed #32 -- exit early on obscenely large values
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant