Skip to content

Commit 7f69c8b

Browse files
[llvm-special-case-list-fuzzer] fix off-by-one read (llvm#73888)
The current fuzzer relies on MemoryBuffer to hold the fuzz data. However, the fuzzer runs into an OOB instantly because the MemoryBuffer interface guarantees that "In addition to basic access to the characters in the file, this interface guarantees you can read one character past the end of the file, and that this character will read as '\0'." [ref](https://llvm.org/doxygen/classllvm_1_1MemoryBuffer.html#details), which the fuzzer fails to satisfy. As such, it runs into an OOB on [this line](https://github.com/llvm/llvm-project/blob/c57ef2c69846a3f69c9d1db61055ea3b7b5100c3/llvm/lib/Support/LineIterator.cpp#L48). Consequently, the OSS-Fuzz set up is not running since the build is declared failing as the fuzzer fails on the first run. See here for links to build logs https://introspector.oss-fuzz.com/project-profile?project=llvm and specifically at the bottom of [this build log](https://oss-fuzz-build-logs.storage.googleapis.com/log-aecaad16-9581-48fe-af4a-a7be4dd947db.txt). This change fixes the fuzzer and should solve the OSS-Fuzz build as well. Signed-off-by: David Korczynski <[email protected]>
1 parent 9d7b357 commit 7f69c8b

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

llvm/tools/llvm-special-case-list-fuzzer/special-case-list-fuzzer.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@
1212
#include <cstdlib>
1313

1414
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
15-
std::unique_ptr<llvm::MemoryBuffer> Buf = llvm::MemoryBuffer::getMemBuffer(
16-
llvm::StringRef(reinterpret_cast<const char *>(Data), Size), "", false);
15+
std::string Payload(reinterpret_cast<const char *>(Data), Size);
16+
std::unique_ptr<llvm::MemoryBuffer> Buf =
17+
llvm::MemoryBuffer::getMemBuffer(Payload);
1718

1819
if (!Buf)
1920
return 0;

0 commit comments

Comments
 (0)